Edit tour

Windows Analysis Report
XClient.exe

Overview

General Information

Sample name:	XClient.exe
Analysis ID:	1587413
MD5:	f814bc67769270c774b0fc4dba88ca5b
SHA1:	2667e6356b19d31bdb9788f2f2348d621b5f1f75
SHA256:	a0b434483513e60b70b966107408e4e707fd9c9605108204d53d5c3cbed9b00c
Tags:	exeuser-zhuzhu0009
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Connects to a pastebin service (likely for C&C)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Machine Learning detection for dropped file

Machine Learning detection for sample

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

XClient.exe (PID: 3672 cmdline: "C:\Users\user\Desktop\XClient.exe" MD5: F814BC67769270C774B0FC4DBA88CA5B)

cmd.exe (PID: 3148 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4450.tmp.bat"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5216 cmdline: timeout 3 MD5: 100065E21CFBBDE57CBA2838921F84D6)

Update.exe (PID: 2976 cmdline: "C:\Users\user\AppData\Roaming\Update.exe" MD5: F814BC67769270C774B0FC4DBA88CA5B)

Update.exe (PID: 4640 cmdline: "C:\Users\user\AppData\Roaming\Update.exe" MD5: F814BC67769270C774B0FC4DBA88CA5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["https://pastebin.com/raw/76WgDu7L"], "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
XClient.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
XClient.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
XClient.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xc8d4:$str01: $VB$Local_Port 0xc901:$str02: $VB$Local_Host 0xaaaa:$str03: get_Jpeg 0xb198:$str04: get_ServicePack 0xe4f5:$str05: Select * from AntivirusProduct 0xedab:$str06: PCRestart 0xedbf:$str07: shutdown.exe /f /r /t 0 0xee71:$str08: StopReport 0xee47:$str09: StopDDos 0xef3d:$str10: sendPlugin 0xefbd:$str11: OfflineKeylogger Not Enabled 0xf115:$str12: -ExecutionPolicy Bypass -File " 0xf892:$str13: Content-length: 5235
XClient.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xdef1:$s6: VirtualBox 0xde4f:$s8: Win32_ComputerSystem 0xfe66:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xff03:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10018:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xf7ad:$cnc4: POST / HTTP/1.1

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Update.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\Update.exe	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xc8d4:$str01: $VB$Local_Port 0xc901:$str02: $VB$Local_Host 0xaaaa:$str03: get_Jpeg 0xb198:$str04: get_ServicePack 0xe4f5:$str05: Select * from AntivirusProduct 0xedab:$str06: PCRestart 0xedbf:$str07: shutdown.exe /f /r /t 0 0xee71:$str08: StopReport 0xee47:$str09: StopDDos 0xef3d:$str10: sendPlugin 0xefbd:$str11: OfflineKeylogger Not Enabled 0xf115:$str12: -ExecutionPolicy Bypass -File " 0xf892:$str13: Content-length: 5235
C:\Users\user\AppData\Roaming\Update.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xdef1:$s6: VirtualBox 0xde4f:$s8: Win32_ComputerSystem 0xfe66:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xff03:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10018:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xf7ad:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1401314764.0000000000332000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1401314764.0000000000332000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xdcf1:$s6: VirtualBox 0xdc4f:$s8: Win32_ComputerSystem 0xfc66:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfd03:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfe18:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xf5ad:$cnc4: POST / HTTP/1.1
00000000.00000002.1787449810.00000000025C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: XClient.exe PID: 3672	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.XClient.exe.330000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.XClient.exe.330000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.XClient.exe.330000.0.unpack	rat_win_xworm_v3	Finds XWorm (version XClient, v3) samples based on characteristic strings	Sekoia.io	0xc8d4:$str01: $VB$Local_Port 0xc901:$str02: $VB$Local_Host 0xaaaa:$str03: get_Jpeg 0xb198:$str04: get_ServicePack 0xe4f5:$str05: Select * from AntivirusProduct 0xedab:$str06: PCRestart 0xedbf:$str07: shutdown.exe /f /r /t 0 0xee71:$str08: StopReport 0xee47:$str09: StopDDos 0xef3d:$str10: sendPlugin 0xefbd:$str11: OfflineKeylogger Not Enabled 0xf115:$str12: -ExecutionPolicy Bypass -File " 0xf892:$str13: Content-length: 5235
0.0.XClient.exe.330000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xdef1:$s6: VirtualBox 0xde4f:$s8: Win32_ComputerSystem 0xfe66:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xff03:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x10018:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xf7ad:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Update.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\XClient.exe, ProcessId: 3672, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\XClient.exe, ProcessId: 3672, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:03:27.768054+0100	2852870	1	Malware Command and Control Activity Detected	147.185.221.25	6073	192.168.2.8	49708	TCP
2025-01-10T11:03:40.182050+0100	2852870	1	Malware Command and Control Activity Detected	147.185.221.25	6073	192.168.2.8	49708	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:03:19.051930+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.166030+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.287767+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.418933+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.549327+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.686041+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.815492+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.191369+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.375366+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.489244+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.598872+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.710451+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.817205+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.926890+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.049332+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.160958+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.270418+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.381559+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.491571+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.599869+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.707856+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.817480+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.926659+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.036485+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.145593+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.254602+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.364708+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.473396+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.582729+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.711401+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.819688+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.005778+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.158284+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.270571+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.379770+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.489659+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.613949+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.723525+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.832979+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.942135+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.051564+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.160881+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.270229+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.379737+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.489206+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.598957+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.708452+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.817363+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.926592+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.037232+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.146333+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.258906+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.364743+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.473540+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.582883+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.692152+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.801483+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.915262+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.020234+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.129668+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.239153+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.348730+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.458032+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.567380+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.676803+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.786800+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.899264+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.005415+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.114488+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.225350+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.333093+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.442458+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.552514+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.661190+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.769763+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49708	147.185.221.25	6073	TCP
2025-01-10T11:03:27.770485+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.880405+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.989057+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.098527+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.207843+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.317305+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.426621+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.535890+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.645657+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.754995+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.864545+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.973671+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.082966+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.192939+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.346343+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.457744+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.567576+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.686372+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.832351+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.071363+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.187451+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.301496+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.411019+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.520372+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.629633+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.739186+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.848334+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.957740+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.067099+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.176504+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.285913+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.405243+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.520257+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.629918+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.739168+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.848449+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.961585+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.069586+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.176605+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.286076+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.398453+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.521101+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.654793+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.815802+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.926630+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.051713+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.160981+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.272007+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.387491+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.489089+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.598501+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.707990+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.817486+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.926423+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.036203+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.146958+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.254842+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.364119+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.484146+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.598428+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.707865+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.817264+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.926611+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.036542+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.146760+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.255416+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.364293+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.630063+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.741569+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.935390+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.054959+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.163476+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.293378+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.396291+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.504955+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.618355+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.723429+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.832962+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.942370+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.051528+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.160951+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.270880+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.379704+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.489143+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.598468+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.707833+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.817183+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.926557+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.036044+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.145351+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.267938+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.448245+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.606936+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.756241+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.864023+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.973382+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.082748+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.192207+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.301558+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.411056+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.520237+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.630563+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.739229+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.855845+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.958405+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:40.067364+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:40.176633+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:03:19.051930+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.166030+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.287767+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.418933+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.549327+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.686041+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.815492+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.191369+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.375366+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.489244+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.598872+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.710451+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.817205+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.926890+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.049332+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.160958+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.270418+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.381559+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.491571+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.599869+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.707856+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.817480+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.926659+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.036485+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.145593+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.254602+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.364708+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.473396+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.582729+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.711401+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.819688+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.005778+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.158284+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.270571+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.379770+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.489659+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.613949+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.723525+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.832979+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.942135+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.051564+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.160881+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.270229+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.379737+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.489206+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.598957+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.708452+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.817363+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.926592+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.037232+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.146333+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.258906+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.364743+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.473540+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.582883+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.692152+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.801483+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.915262+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.020234+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.129668+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.239153+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.348730+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.458032+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.567380+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.676803+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.786800+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.899264+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.005415+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.114488+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.225350+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.333093+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.442458+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.552514+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.661190+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.770485+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.880405+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.989057+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.098527+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.207843+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.317305+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.426621+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.535890+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.645657+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.754995+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.864545+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.973671+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.082966+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.192939+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.346343+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.457744+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.567576+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.686372+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.832351+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.071363+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.187451+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.301496+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.411019+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.520372+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.629633+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.739186+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.848334+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.957740+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.067099+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.176504+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.285913+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.405243+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.520257+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.629918+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.739168+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.848449+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.961585+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.069586+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.176605+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.286076+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.398453+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.521101+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.654793+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.815802+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.926630+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.051713+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.160981+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.272007+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.387491+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.489089+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.598501+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.707990+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.817486+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.926423+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.036203+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.146958+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.254842+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.364119+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.484146+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.598428+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.707865+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.817264+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.926611+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.036542+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.146760+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.255416+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.364293+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.630063+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.741569+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.935390+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.054959+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.163476+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.293378+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.396291+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.504955+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.618355+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.723429+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.832962+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.942370+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.051528+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.160951+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.270880+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.379704+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.489143+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.598468+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.707833+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.817183+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.926557+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.036044+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.145351+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.267938+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.448245+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.606936+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.756241+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.864023+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.973382+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.082748+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.192207+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.301558+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.411056+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.520237+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.630563+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.739229+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.855845+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.958405+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:40.067364+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:40.176633+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.8	49711	147.185.221.25	6073	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:03:27.400659+0100	2855924	1	Malware Command and Control Activity Detected	192.168.2.8	49708	147.185.221.25	6073	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:03:18.831758+0100	2853191	1	Malware Command and Control Activity Detected	147.185.221.25	6073	192.168.2.8	49708	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T11:03:18.370793+0100	2853192	1	Malware Command and Control Activity Detected	192.168.2.8	49708	147.185.221.25	6073	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: XClient.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Update.exe

Avira: detection malicious, Label: HEUR/AGEN.1305769

Found malware configuration

Source: XClient.exe

Malware Configuration Extractor: Xworm {"C2 url": ["https://pastebin.com/raw/76WgDu7L"], "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Update.exe	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\Update.exe	Virustotal: Detection: 68%			Perma Link

Multi AV Scanner detection for submitted file

Source: XClient.exe	Virustotal: Detection: 68%			Perma Link
Source: XClient.exe	ReversingLabs: Detection: 73%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Update.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: XClient.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: XClient.exe	String decryptor: https://pastebin.com/raw/76WgDu7L
Source: XClient.exe	String decryptor: <123456789>
Source: XClient.exe	String decryptor: <Xwormmm>
Source: XClient.exe	String decryptor: XWorm V5.6
Source: XClient.exe	String decryptor: USB.exe
Source: XClient.exe	String decryptor: %AppData%
Source: XClient.exe	String decryptor: Update.exe

Source: XClient.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.8:49707 version: TLS 1.2

Source: XClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\XClient.exe	Code function: 4x nop then jmp 00007FFB4B040134h	0_2_00007FFB4B03FAB9
Source: C:\Users\user\Desktop\XClient.exe	Code function: 4x nop then jmp 00007FFB4B040145h	0_2_00007FFB4B03FAB9
Source: C:\Users\user\Desktop\XClient.exe	Code function: 4x nop then jmp 00007FFB4B03EF62h	0_2_00007FFB4B03EDB5
Source: C:\Users\user\Desktop\XClient.exe	Code function: 4x nop then jmp 00007FFB4B040D04h	0_2_00007FFB4B03C0B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2852873 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 : 192.168.2.8:49711 -> 147.185.221.25:6073
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.8:49711 -> 147.185.221.25:6073
Source: Network traffic	Suricata IDS: 2853192 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound : 192.168.2.8:49708 -> 147.185.221.25:6073
Source: Network traffic	Suricata IDS: 2853191 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound : 147.185.221.25:6073 -> 192.168.2.8:49708
Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.8:49708 -> 147.185.221.25:6073
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 147.185.221.25:6073 -> 192.168.2.8:49708
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.8:49708 -> 147.185.221.25:6073

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://pastebin.com/raw/76WgDu7L

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Yara detected Generic Downloader

Source: Yara match	File source: XClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.XClient.exe.330000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 147.185.221.25:6073

Source: global traffic	HTTP traffic detected: GET /raw/76WgDu7L HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25
Source: unknown	TCP traffic detected without corresponding DNS query: 147.185.221.25

Source: global traffic	HTTP traffic detected: GET /raw/76WgDu7L HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: pastebin.com

Source: XClient.exe, 00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: XClient.exe, Update.exe.0.dr	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: XClient.exe, 00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: XClient.exe, 00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com
Source: Update.exe, 00000006.00000002.1690611640.0000000002881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/76WgDu7L

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707

Source: unknown

HTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.8:49707 version: TLS 1.2

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\XClient.exe	Process information set: 01 00 00 00			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: 00 00 00 00			Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: XClient.exe, type: SAMPLE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: XClient.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.XClient.exe.330000.0.unpack, type: UNPACKEDPE	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: 0.0.XClient.exe.330000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1401314764.0000000000332000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: Finds XWorm (version XClient, v3) samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFB4B036C72	0_2_00007FFB4B036C72
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFB4B03DADA	0_2_00007FFB4B03DADA
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFB4B035EC6	0_2_00007FFB4B035EC6
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFB4B0316C9	0_2_00007FFB4B0316C9
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFB4B03C248	0_2_00007FFB4B03C248
Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFB4B031F0D	0_2_00007FFB4B031F0D
Source: C:\Users\user\AppData\Roaming\Update.exe	Code function: 5_2_00007FFB4B0516C9	5_2_00007FFB4B0516C9
Source: C:\Users\user\AppData\Roaming\Update.exe	Code function: 5_2_00007FFB4B050FE8	5_2_00007FFB4B050FE8
Source: C:\Users\user\AppData\Roaming\Update.exe	Code function: 5_2_00007FFB4B051F0D	5_2_00007FFB4B051F0D
Source: C:\Users\user\AppData\Roaming\Update.exe	Code function: 6_2_00007FFB4B0416C9	6_2_00007FFB4B0416C9
Source: C:\Users\user\AppData\Roaming\Update.exe	Code function: 6_2_00007FFB4B040FE8	6_2_00007FFB4B040FE8
Source: C:\Users\user\AppData\Roaming\Update.exe	Code function: 6_2_00007FFB4B041F0D	6_2_00007FFB4B041F0D

Source: XClient.exe, 00000000.00000002.1789188962.000000001C840000.00000004.08000000.00040000.00000000.sdmp

Binary or memory string: OriginalFilenameRemoteDesktop.dll< vs XClient.exe

Source: XClient.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: XClient.exe, type: SAMPLE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: XClient.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.XClient.exe.330000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: 0.0.XClient.exe.330000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1401314764.0000000000332000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: rat_win_xworm_v3 author = Sekoia.io, description = Finds XWorm (version XClient, v3) samples based on characteristic strings, creation_date = 2023-03-03, classification = TLP:CLEAR, version = 1.0, id = 5fb1cbd3-1e37-43b9-9606-86d896f2150b, hash = de0127ba872c0677c3594c66b2298edea58d097b5fa697302a16b1689147b147
Source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/6@2/3

Source: C:\Users\user\Desktop\XClient.exe

File created: C:\Users\user\AppData\Roaming\Update.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Update.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\XClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\lOn6sgKFvEzVrOP0
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3724:120:WilError_03

Source: C:\Users\user\Desktop\XClient.exe

File created: C:\Users\user\AppData\Local\Temp\tmp4450.tmp

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4450.tmp.bat""

Source: XClient.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: XClient.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\XClient.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: XClient.exe	Virustotal: Detection: 68%
Source: XClient.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\Desktop\XClient.exe

File read: C:\Users\user\Desktop\XClient.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\XClient.exe "C:\Users\user\Desktop\XClient.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Update.exe "C:\Users\user\AppData\Roaming\Update.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Update.exe "C:\Users\user\AppData\Roaming\Update.exe"
Source: C:\Users\user\Desktop\XClient.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4450.tmp.bat""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3
Source: C:\Users\user\Desktop\XClient.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4450.tmp.bat""	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Update.lnk.0.dr

LNK file: ..\..\..\..\..\Update.exe

Source: XClient.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: XClient.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\XClient.exe	Code function: 0_2_00007FFB4B03754C pushad ; ret		0_2_00007FFB4B03755A
Source: C:\Users\user\AppData\Roaming\Update.exe	Code function: 6_2_00007FFB4B0406D9 push edi; ret		6_2_00007FFB4B0406DA

Source: C:\Users\user\Desktop\XClient.exe

File created: C:\Users\user\AppData\Roaming\Update.exe

Jump to dropped file

Source: C:\Users\user\Desktop\XClient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update			Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\EF317FDFBD80D532EB57 CC52384910CEE944DDBCC575A8E0177BFA6B16E3032438B207797164D5C94B34

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\XClient.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: XClient.exe, Update.exe.0.dr

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\XClient.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Memory allocated: 1A570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Memory allocated: D80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Memory allocated: 1A8E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Memory allocated: B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Memory allocated: 1A870000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598576	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598467	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598247	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597817	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597622	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597439	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595039	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594811	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Window / User API: threadDelayed 2972			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Window / User API: threadDelayed 6836			Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -598576s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -598467s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -598360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -598247s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -598141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -597969s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -597817s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -597622s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -597439s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -597313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -597203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -597094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -596860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -596735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -595039s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -594811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -594656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -594438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe TID: 1196	Thread sleep time: -594313s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe TID: 3032	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe TID: 4260	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598576	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598467	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598360	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598247	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 598141	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597969	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597817	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597622	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597439	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597313	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597203	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 597094	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596860	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596735	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 595039	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594811	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594438	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Thread delayed: delay time: 594313	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Update.exe.0.dr	Binary or memory string: vmware
Source: XClient.exe, Update.exe.0.dr	Binary or memory string: dZPaqkVDyB0fixb09lStaaGzXDGEzlvzoreQ1fymJOAbEG8M6efKakukqEmUJ9M
Source: XClient.exe, 00000000.00000002.1788462449.000000001B3CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\XClient.exe

Code function: 0_2_00007FFB4B037881 CheckRemoteDebuggerPresent,

0_2_00007FFB4B037881

Source: C:\Users\user\Desktop\XClient.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4450.tmp.bat""			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout 3			Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe	Queries volume information: C:\Users\user\Desktop\XClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\XClient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Queries volume information: C:\Users\user\AppData\Roaming\Update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Update.exe	Queries volume information: C:\Users\user\AppData\Roaming\Update.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\XClient.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: XClient.exe, 00000000.00000002.1788529914.000000001B411000.00000004.00000020.00020000.00000000.sdmp, XClient.exe, 00000000.00000002.1788839700.000000001B4BC000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\XClient.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: XClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.XClient.exe.330000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1401314764.0000000000332000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1787449810.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 3672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: XClient.exe, type: SAMPLE
Source: Yara match	File source: 0.0.XClient.exe.330000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1401314764.0000000000332000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1787449810.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XClient.exe PID: 3672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Update.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	12 Windows Management Instrumentation	1 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	541 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	21 Registry Run Keys / Startup Folder	21 Registry Run Keys / Startup Folder	1 Modify Registry	LSASS Memory	151 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	151 Virtualization/Sandbox Evasion	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
XClient.exe	68%	Virustotal		Browse
XClient.exe	74%	ReversingLabs	Win32.Exploit.Xworm
XClient.exe	100%	Avira	HEUR/AGEN.1305769
XClient.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Update.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\user\AppData\Roaming\Update.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Update.exe	74%	ReversingLabs	Win32.Exploit.Xworm
C:\Users\user\AppData\Roaming\Update.exe	68%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	false		high
pastebin.com	104.20.4.235	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/76WgDu7L	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	XClient.exe, 00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp	false	high
https://pastebin.com	XClient.exe, 00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ip-api.com	XClient.exe, 00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	false
147.185.221.25	unknown	United States	12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587413
Start date and time:	2025-01-10 11:02:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	XClient.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/6@2/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 39 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Update.exe, PID 2976 because it is empty
Execution Graph export aborted for target Update.exe, PID 4640 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:03:05	API Interceptor	236x Sleep call for process: XClient.exe modified
11:03:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Update C:\Users\user\AppData\Roaming\Update.exe
11:03:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Update C:\Users\user\AppData\Roaming\Update.exe
11:03:26	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	Comprobante.de.pago.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	p.exe	Get hash	malicious	Unknown	Browse	ip-api.com/csv/?fields=query
	rNuevaorden_pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	I334hDwRjj.exe	Get hash	malicious	Blank Grabber, Njrat	Browse	ip-api.com/json/?fields=225545
	startup_str_466.bat	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	7dtpow.ps1	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	x.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	TR98760H.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	47SXvEQ.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse	ip-api.com/json/?fields=225545
	test.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	ip-api.com/json/
104.20.4.235	gabe.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	gaber.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	pastebin.com/raw/sA04Mwk2
	sostener.vbs	Get hash	malicious	Njrat	Browse	pastebin.com/raw/V9y5Q5vv
	sostener.vbs	Get hash	malicious	XWorm	Browse	pastebin.com/raw/V9y5Q5vv
	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	18e568eb4ca89f8a3e4f04b1eb15472b55b4548f4d153.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
	Solara_v3.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	Solara_v3.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	Drivespan.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	XClient.exe	Get hash	malicious	XWorm	Browse	172.67.19.24
	ogVinh0jhq.exe	Get hash	malicious	DCRat	Browse	104.20.4.235
	hiwA7Blv7C.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	CRf9KBk4ra.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	104.20.3.235
ip-api.com	Comprobante.de.pago.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	p.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	rNuevaorden_pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	I334hDwRjj.exe	Get hash	malicious	Blank Grabber, Njrat	Browse	208.95.112.1
	startup_str_466.bat	Get hash	malicious	XWorm	Browse	208.95.112.1
	7dtpow.ps1	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	x.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	TR98760H.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	47SXvEQ.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse	208.95.112.1
	test.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	Comprobante.de.pago.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	p.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	rNuevaorden_pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	I334hDwRjj.exe	Get hash	malicious	Blank Grabber, Njrat	Browse	208.95.112.1
	startup_str_466.bat	Get hash	malicious	XWorm	Browse	208.95.112.1
	7dtpow.ps1	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	x.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	TR98760H.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	47SXvEQ.exe	Get hash	malicious	Blank Grabber, Xmrig	Browse	208.95.112.1
	test.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	208.95.112.1
CLOUDFLARENETUS	http://www.efnhdh.blogspot.mk/	Get hash	malicious	GRQ Scam	Browse	172.67.12.83
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	http://pdfdrive.com.co	Get hash	malicious	Unknown	Browse	104.21.11.245
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	https://ctrk.klclick3.com/l/01JGXREPA9AKCFABSME4GFWDDZ_0#YWxhaW5femllZ2xlckB6aWVnbGVyZ3JvdXAuY29t	Get hash	malicious	Unknown	Browse	172.66.43.95
	http://www.singhs.lv	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.18.11.207
	http://18ofcontents.shop	Get hash	malicious	Unknown	Browse	104.21.96.1
	https://www.dcamarketintelligence.com/tdt	Get hash	malicious	Unknown	Browse	104.26.15.92
	1162-201.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	https://cdn.btmessage.com/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.232
SALSGIVERUS	DkvES47bkt.exe	Get hash	malicious	Unknown	Browse	147.185.221.24
	startup_str_466.bat	Get hash	malicious	XWorm	Browse	147.185.221.24
	Fixer.exe	Get hash	malicious	RedLine, SheetRat	Browse	147.185.221.24
	Fixer.exe	Get hash	malicious	RedLine	Browse	147.185.221.24
	spreadmalware.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	7fqul5Zr8Y.exe	Get hash	malicious	Unknown	Browse	147.185.221.24
	miori.arm.elf	Get hash	malicious	Unknown	Browse	147.168.252.34
	miori.m68k.elf	Get hash	malicious	Unknown	Browse	147.184.86.253
	loader.exe	Get hash	malicious	Unknown	Browse	147.185.221.24
	loader.exe	Get hash	malicious	Unknown	Browse	147.185.221.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.20.4.235
	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	104.20.4.235
	https://aqctslc.com/	Get hash	malicious	Unknown	Browse	104.20.4.235
	https://sacredartscommunications.com/	Get hash	malicious	HTMLPhisher	Browse	104.20.4.235
	http://stonecoldstalley.com/	Get hash	malicious	Unknown	Browse	104.20.4.235
	RFQ-12202430_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	PaymentAdvice.html	Get hash	malicious	KnowBe4	Browse	104.20.4.235
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.20.4.235
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.20.4.235
	PO-12202432_ACD_Group.pif.exe	Get hash	malicious	Unknown	Browse	104.20.4.235

Process:	C:\Users\user\AppData\Roaming\Update.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

Download File

Process:	C:\Users\user\Desktop\XClient.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	5.3718223239563105
Encrypted:	false
SSDEEP:	48:MxHKQwYHKGSI6o6+vxp3/elZHNpOtHTHhAHKKkt1qHGIs0HKD:iqbYqGSI6o9Zp/elZtpOtzHeqKktwmjB
MD5:	9714380A7DC1A8945C07B6C9DC8312B0
SHA1:	E6DF51F4C72B17485883378FDBF28D6BB5CFFDF3
SHA-256:	1DD30FC94BA3D3F97B5F250110A2639430AEB51FAE7A252F886AE2401EC31D4B
SHA-512:	876FB2C042F5FC60F6ACE9D143BA1A3AC9E200124EA3CB12476D10D24D82B4F2394F045E56FEB8906872D01B00BF9E646DEECC384144E21AEB6D6C10A365FB10
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.

C:\Users\user\AppData\Local\Temp\tmp4450.tmp.bat

Download File

Process:	C:\Users\user\Desktop\XClient.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	150
Entropy (8bit):	5.005722938982854
Encrypted:	false
SSDEEP:	3:mKDDCMNqTtv3DCHyOWORHvhs99m9NQDwU1hGDCHyg4E2J5xAInTRI7yloL1ZPy:hWKqTtLCH7O9mNQDNeCHhJ23fTDwk
MD5:	9F0D1F9F2A188FB55300BB0E6CA47CEB
SHA1:	7AB7771083C470CD690FEAF9277E61357CB010CF
SHA-256:	BA220081FA99B593728E45D85D33F14DA16CB3FC7A26A1BB03FE5C2759777A42
SHA-512:	075AC25DDDE403E7480B5C35FA13762D06A7FEEA8B16001820CFA40EA3357EE50926CD6E573E4EF82692E6DE5325CDF53421039E5352640189156D216BDB67F0
Malicious:	false
Reputation:	low
Preview:	@echo off..timeout 3 > NUL..CD C:\Users\user\Desktop..DEL "XClient.exe" /f /q..CD C:\Users\user\AppData\Local\Temp\..DEL "tmp4450.tmp.bat" /f /q..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk

Download File

Process:	C:\Users\user\Desktop\XClient.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Jan 10 09:03:05 2025, mtime=Fri Jan 10 09:03:05 2025, atime=Fri Jan 10 09:03:05 2025, length=74240, window=hide
Category:	dropped
Size (bytes):	760
Entropy (8bit):	5.064836891739229
Encrypted:	false
SSDEEP:	12:8klvg4qkChlY//6/LWEHKq8kCjAsGUH17SF7SF9mV:8klpPN0Bqq8bAsDSF7SF9m
MD5:	F086459AAD4B02F33D571B427373B119
SHA1:	F4DA96A2DAFC888BE49C1A31D71019DF949F4A6F
SHA-256:	B64C6E5AA472B7EABD427335716AB83143BFC5DEA7AAD2DE48F9AD776ED4485C
SHA-512:	AA0BF464930166ACE5DF9C96958B2C603EB62B74BBA997590AAE06D9EDD324DA4CF1E844E1F8B6B6BA7CECFD4CE7B519913037A45738A97F59D40B0523786E1F
Malicious:	false
Preview:	L..................F.... ......Fc.....Fc.....Fc..."......................t.:..DG..Yr?.D..U..k0.&...&.......y.Yd.......Fc.....Fc......t...CFSF..1.....EW)B..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EW)BZ]P..........................d...A.p.p.D.a.t.a...B.V.1.....Z[P..Roaming.@......EW)BZ[P...........................F3.R.o.a.m.i.n.g.....`.2.."..ZcP .Update.exe..F......ZcPZcP....S#.....................A.U.p.d.a.t.e...e.x.e.......Y...............-.......X.............ju.....C:\Users\user\AppData\Roaming\Update.exe........\.....\.....\.....\.....\.U.p.d.a.t.e...e.x.e.`.......X.......841618...........hT..CrF.f4... ..H..Yc...,...E...hT..CrF.f4... ..H..Yc...,...E..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Update.exe

Download File

Process:	C:\Users\user\Desktop\XClient.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	74240
Entropy (8bit):	6.00077116064688
Encrypted:	false
SSDEEP:	1536:R0VnpAIVqo23E0/SCbrDPGGAEZ5XRO51ny:MLt0/ZbfPbZ5XRO51ny
MD5:	F814BC67769270C774B0FC4DBA88CA5B
SHA1:	2667E6356B19D31BDB9788F2F2348D621B5F1F75
SHA-256:	A0B434483513E60B70B966107408E4E707FD9C9605108204D53D5C3CBED9B00C
SHA-512:	2204B8798FFBE6EF592630CC81FAF76C780C5B87C9A14FB898F3E965851ED6A0818D97D95A2080127528C8593D3317D6FE10F0AB584B7053D88855387962C941
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 74% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....g.............................7... ...@....@.. ....................................@..................................7..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......tZ..(.......&.....................................................(.....r...p. .....(.....r/..p. .x!..s.........s.........s.........s..........r...p. w....r...p. .(T..r...p. .g...rK..p.r...p. ..'...((....r...p. .....rq..p.(+...-.(,...,.+.(-...,.+.(...,.+.()...,..(S...&(....&+..+5sb... .... .'..oc...(...~....-.(\...(N...~....od...&.-..rj..p. ..e..r1..p. ..<..r...p. o....rJ..p. F...r...p.r...p. U....r@..p. ~.H..r...p. E/..*.r...p

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.41440934524794
Encrypted:	false
SSDEEP:	3:hYFqdLGAR+mQRKVxLZXt0sn:hYFqGaNZKsn
MD5:	3DD7DD37C304E70A7316FE43B69F421F
SHA1:	A3754CFC33E9CA729444A95E95BCB53384CB51E4
SHA-256:	4FA27CE1D904EA973430ADC99062DCF4BAB386A19AB0F8D9A4185FA99067F3AA
SHA-512:	713533E973CF0FD359AC7DB22B1399392C86D9FD1E715248F5724AAFBBF0EEB5EAC0289A0E892167EB559BE976C2AD0A0A0D8EFC407FFAF5B3C3A32AA9A0AAA4
Malicious:	false
Preview:	..Waiting for 3 seconds, press a key to continue ....2.1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.00077116064688
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	XClient.exe
File size:	74'240 bytes
MD5:	f814bc67769270c774b0fc4dba88ca5b
SHA1:	2667e6356b19d31bdb9788f2f2348d621b5f1f75
SHA256:	a0b434483513e60b70b966107408e4e707fd9c9605108204d53d5c3cbed9b00c
SHA512:	2204b8798ffbe6ef592630cc81faf76c780c5b87c9a14fb898f3e965851ed6a0818d97d95a2080127528c8593d3317d6fe10f0ab584b7053d88855387962c941
SSDEEP:	1536:R0VnpAIVqo23E0/SCbrDPGGAEZ5XRO51ny:MLt0/ZbfPbZ5XRO51ny
TLSH:	67737D283BE60129F1FFEFB55DF13162CA35F2236607AA6F24C901861623A85CD51BF5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.............................7... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4137ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6780E31C [Fri Jan 10 09:06:36 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1379c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x4ce	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x16000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x117f4	0x11800	b454e47460d290c93a9ac78db1cb7c64	False	0.61806640625	data	6.072710445723449	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x14000	0x4ce	0x600	f9052177c59fad11b6e11866b69a673f	False	0.375	data	3.726864092899557	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x16000	0xc	0x200	5c12ca2d24911b3272554ad952b35c5b	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x140a0	0x244	data			0.4724137931034483
RT_MANIFEST	0x142e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T11:03:18.370793+0100	2853192	ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound	1	192.168.2.8	49708	147.185.221.25	6073	TCP
2025-01-10T11:03:18.831758+0100	2853191	ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound	1	147.185.221.25	6073	192.168.2.8	49708	TCP
2025-01-10T11:03:19.051930+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.051930+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.166030+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.166030+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.287767+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.287767+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.418933+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.418933+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.549327+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.549327+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.686041+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.686041+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.815492+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:19.815492+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.191369+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.191369+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.375366+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.375366+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.489244+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.489244+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.598872+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.598872+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.710451+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.710451+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.817205+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.817205+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.926890+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:20.926890+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.049332+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.049332+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.160958+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.160958+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.270418+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.270418+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.381559+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.381559+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.491571+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.491571+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.599869+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.599869+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.707856+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.707856+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.817480+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.817480+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.926659+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:21.926659+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.036485+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.036485+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.145593+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.145593+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.254602+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.254602+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.364708+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.364708+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.473396+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.473396+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.582729+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.582729+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.711401+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.711401+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.819688+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:22.819688+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.005778+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.005778+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.158284+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.158284+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.270571+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.270571+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.379770+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.379770+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.489659+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.489659+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.613949+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.613949+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.723525+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.723525+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.832979+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.832979+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.942135+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:23.942135+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.051564+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.051564+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.160881+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.160881+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.270229+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.270229+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.379737+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.379737+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.489206+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.489206+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.598957+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.598957+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.708452+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.708452+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.817363+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.817363+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.926592+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:24.926592+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.037232+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.037232+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.146333+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.146333+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.258906+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.258906+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.364743+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.364743+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.473540+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.473540+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.582883+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.582883+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.692152+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.692152+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.801483+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.801483+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.915262+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:25.915262+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.020234+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.020234+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.129668+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.129668+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.239153+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.239153+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.348730+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.348730+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.458032+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.458032+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.567380+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.567380+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.676803+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.676803+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.786800+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.786800+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.899264+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:26.899264+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.005415+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.005415+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.114488+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.114488+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.225350+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.225350+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.333093+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.333093+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.400659+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.8	49708	147.185.221.25	6073	TCP
2025-01-10T11:03:27.442458+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.442458+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.552514+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.552514+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.661190+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.661190+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.768054+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	147.185.221.25	6073	192.168.2.8	49708	TCP
2025-01-10T11:03:27.769763+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49708	147.185.221.25	6073	TCP
2025-01-10T11:03:27.770485+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.770485+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.880405+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.880405+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.989057+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:27.989057+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.098527+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.098527+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.207843+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.207843+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.317305+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.317305+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.426621+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.426621+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.535890+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.535890+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.645657+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.645657+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.754995+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.754995+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.864545+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.864545+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.973671+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:28.973671+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.082966+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.082966+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.192939+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.192939+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.346343+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.346343+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.457744+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.457744+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.567576+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.567576+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.686372+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.686372+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.832351+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:29.832351+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.071363+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.071363+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.187451+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.187451+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.301496+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.301496+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.411019+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.411019+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.520372+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.520372+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.629633+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.629633+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.739186+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.739186+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.848334+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.848334+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.957740+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:30.957740+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.067099+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.067099+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.176504+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.176504+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.285913+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.285913+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.405243+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.405243+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.520257+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.520257+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.629918+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.629918+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.739168+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.739168+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.848449+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.848449+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.961585+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:31.961585+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.069586+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.069586+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.176605+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.176605+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.286076+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.286076+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.398453+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.398453+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.521101+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.521101+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.654793+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.654793+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.815802+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.815802+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.926630+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:32.926630+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.051713+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.051713+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.160981+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.160981+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.272007+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.272007+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.387491+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.387491+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.489089+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.489089+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.598501+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.598501+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.707990+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.707990+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.817486+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.817486+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.926423+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:33.926423+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.036203+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.036203+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.146958+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.146958+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.254842+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.254842+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.364119+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.364119+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.484146+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.484146+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.598428+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.598428+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.707865+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.707865+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.817264+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.817264+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.926611+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:34.926611+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.036542+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.036542+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.146760+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.146760+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.255416+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.255416+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.364293+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.364293+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.630063+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.630063+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.741569+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.741569+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.935390+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:35.935390+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.054959+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.054959+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.163476+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.163476+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.293378+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.293378+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.396291+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.396291+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.504955+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.504955+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.618355+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.618355+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.723429+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.723429+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.832962+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.832962+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.942370+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:36.942370+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.051528+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.051528+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.160951+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.160951+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.270880+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.270880+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.379704+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.379704+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.489143+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.489143+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.598468+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.598468+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.707833+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.707833+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.817183+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.817183+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.926557+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:37.926557+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.036044+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.036044+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.145351+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.145351+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.267938+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.267938+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.448245+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.448245+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.606936+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.606936+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.756241+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.756241+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.864023+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.864023+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.973382+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:38.973382+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.082748+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.082748+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.192207+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.192207+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.301558+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.301558+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.411056+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.411056+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.520237+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.520237+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.630563+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.630563+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.739229+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.739229+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.855845+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.855845+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.958405+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:39.958405+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:40.067364+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:40.067364+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:40.176633+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:40.176633+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.8	49711	147.185.221.25	6073	TCP
2025-01-10T11:03:40.182050+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	147.185.221.25	6073	192.168.2.8	49708	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:03:05.424772978 CET	49706	80	192.168.2.8	208.95.112.1
Jan 10, 2025 11:03:05.430085897 CET	80	49706	208.95.112.1	192.168.2.8
Jan 10, 2025 11:03:05.430156946 CET	49706	80	192.168.2.8	208.95.112.1
Jan 10, 2025 11:03:05.430852890 CET	49706	80	192.168.2.8	208.95.112.1
Jan 10, 2025 11:03:05.436332941 CET	80	49706	208.95.112.1	192.168.2.8
Jan 10, 2025 11:03:05.886295080 CET	80	49706	208.95.112.1	192.168.2.8
Jan 10, 2025 11:03:05.941900969 CET	49706	80	192.168.2.8	208.95.112.1
Jan 10, 2025 11:03:07.040683985 CET	49707	443	192.168.2.8	104.20.4.235
Jan 10, 2025 11:03:07.040718079 CET	443	49707	104.20.4.235	192.168.2.8
Jan 10, 2025 11:03:07.040770054 CET	49707	443	192.168.2.8	104.20.4.235
Jan 10, 2025 11:03:07.055841923 CET	49707	443	192.168.2.8	104.20.4.235
Jan 10, 2025 11:03:07.055859089 CET	443	49707	104.20.4.235	192.168.2.8
Jan 10, 2025 11:03:07.528302908 CET	443	49707	104.20.4.235	192.168.2.8
Jan 10, 2025 11:03:07.528422117 CET	49707	443	192.168.2.8	104.20.4.235
Jan 10, 2025 11:03:07.531070948 CET	49707	443	192.168.2.8	104.20.4.235
Jan 10, 2025 11:03:07.531100035 CET	443	49707	104.20.4.235	192.168.2.8
Jan 10, 2025 11:03:07.531474113 CET	443	49707	104.20.4.235	192.168.2.8
Jan 10, 2025 11:03:07.578171015 CET	49707	443	192.168.2.8	104.20.4.235
Jan 10, 2025 11:03:07.623322010 CET	443	49707	104.20.4.235	192.168.2.8
Jan 10, 2025 11:03:07.821177006 CET	443	49707	104.20.4.235	192.168.2.8
Jan 10, 2025 11:03:07.821419954 CET	443	49707	104.20.4.235	192.168.2.8
Jan 10, 2025 11:03:07.821708918 CET	49707	443	192.168.2.8	104.20.4.235
Jan 10, 2025 11:03:07.835700035 CET	49707	443	192.168.2.8	104.20.4.235
Jan 10, 2025 11:03:12.692662001 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:12.697530031 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:12.697609901 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:12.760267019 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:12.765083075 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.302982092 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.348249912 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.370793104 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.375813007 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.831758022 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.831773996 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.831856012 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.843662977 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.843683958 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.843712091 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.843730927 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.854583025 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.854594946 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.854607105 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.854639053 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.854660988 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.861680031 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.861690998 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.861759901 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.873349905 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.873362064 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.873373032 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.873431921 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.883853912 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.883909941 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.883939028 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.926309109 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.952306986 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.957108021 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:18.957181931 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.970269918 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:18.975080013 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:19.051929951 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:19.056726933 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:19.166029930 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:19.171488047 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:19.287766933 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:19.292711973 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:19.418932915 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:19.423778057 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:19.549326897 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:19.554236889 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:19.686041117 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:19.690897942 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:19.815491915 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:19.820404053 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.191369057 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:20.196285009 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.375365973 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:20.380228043 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.489243984 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:20.494107008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.598871946 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:20.603781939 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.614662886 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.660695076 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:20.705430031 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:20.710388899 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.710413933 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.710448027 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.710450888 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:20.710551023 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.710628986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.755283117 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.817204952 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:20.822016954 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:20.926889896 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:20.931730986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.049331903 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.054347038 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.160958052 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.165821075 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.270417929 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.275302887 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.381558895 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.386451006 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.491570950 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.496499062 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.599869013 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.604881048 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.707855940 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.712757111 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.817480087 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.822369099 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.926659107 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.931627989 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.949665070 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.980988979 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:21.986973047 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.987356901 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:21.987365961 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.036484957 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:22.087250948 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.145592928 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:22.150535107 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.254601955 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:22.259854078 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.364707947 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:22.369792938 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.473396063 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:22.478620052 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.582729101 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:22.587718964 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.621470928 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.664577007 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:22.669543982 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.669670105 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.669735909 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.669820070 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.711277008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.711400986 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:22.716337919 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:22.819688082 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:22.824681997 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.005778074 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.010838985 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.158283949 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.163333893 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.244894028 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.270570993 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.275417089 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.276542902 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.280328989 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.280354977 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.280438900 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.280481100 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.379770041 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.384732962 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.489659071 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.494878054 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.613949060 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.619193077 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.663028955 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.707571983 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.723525047 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.728598118 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.775985956 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.781022072 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781274080 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781289101 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781297922 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781306982 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781316996 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781344891 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781352997 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781397104 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781405926 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781481028 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781490088 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781569958 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781575918 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781625986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781701088 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781711102 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.781718016 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785696983 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785717010 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785726070 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785737991 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785832882 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785845995 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785867929 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785880089 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785944939 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.785955906 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786010027 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786020994 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786032915 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786045074 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786067963 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786079884 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786091089 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786140919 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786153078 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786191940 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786205053 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.786230087 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.832978964 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.838067055 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:23.942135096 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:23.949526072 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.051563978 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.056452990 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.160881042 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.165755033 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.270229101 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.275146961 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.379736900 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.384735107 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.489206076 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.494107008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.598957062 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.603975058 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.708451986 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.713326931 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.774283886 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.817362070 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.817363024 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.822581053 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.888822079 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.894000053 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894038916 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894067049 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894117117 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894144058 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894212961 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894239902 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894306898 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894332886 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894448996 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894475937 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894594908 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894622087 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894648075 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894675016 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894717932 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894766092 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894793987 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894819021 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894865990 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894891977 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894917965 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894943953 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.894990921 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895018101 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895045042 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895070076 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895096064 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895121098 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895169020 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895195007 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895221949 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895247936 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895272970 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895298004 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895343065 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895391941 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895417929 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895442963 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895468950 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895493984 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895519018 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895544052 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895570040 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895616055 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895642042 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.895668030 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:24.926592112 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:24.931524038 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.037231922 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.042289019 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.146332979 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.151654005 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.258905888 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.268294096 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.364742994 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.369766951 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.473540068 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.478441954 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.563513994 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.582882881 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.588469028 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.681507111 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.686707973 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.686729908 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.686933041 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.686944008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.686986923 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687005043 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687115908 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687124968 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687170982 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687180042 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687220097 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687237024 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687297106 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687305927 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687362909 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687371969 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687422991 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687432051 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687500000 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687509060 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687608004 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687617064 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687625885 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687633991 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687644958 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687660933 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687702894 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687747955 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687778950 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687809944 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687886953 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687896013 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687938929 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.687947989 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688045979 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688055038 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688112974 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688122034 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688138008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688152075 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688191891 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688200951 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688240051 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688256979 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688311100 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688321114 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.688329935 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.692152023 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.696954966 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.801482916 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.914993048 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:25.915261984 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:25.920114040 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.020234108 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.025063992 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.129667997 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.134641886 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.239152908 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.244014025 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.348730087 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.353605032 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.371814013 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.426415920 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.458031893 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.498668909 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.503245115 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.503668070 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.503731012 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.503774881 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.503784895 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.503887892 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.503896952 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.503952980 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.503993988 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504054070 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504062891 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504074097 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504144907 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504154921 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504163027 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504208088 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504216909 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504234076 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504242897 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504280090 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504288912 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504301071 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504314899 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504326105 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504340887 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504410028 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504417896 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504462957 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504471064 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504487991 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504496098 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504508018 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504515886 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504578114 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504586935 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504602909 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504611015 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504656076 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504673004 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504683018 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504698992 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504817009 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504826069 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504867077 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504875898 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504924059 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504931927 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.504940033 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.567379951 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.572321892 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.676803112 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.681663036 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.786799908 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.791773081 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:26.899264097 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:26.904175997 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.005414963 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.010265112 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.114487886 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.119488001 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.155915022 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.207765102 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.225349903 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.275281906 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.293898106 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.299031973 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299047947 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299160957 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299186945 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299320936 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299330950 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299401999 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299412012 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299447060 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299531937 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299540997 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299550056 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299639940 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299648046 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299720049 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299729109 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299799919 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299808979 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299858093 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299866915 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299917936 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299926043 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299981117 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.299989939 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300035954 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300045013 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300081968 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300164938 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300173998 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300182104 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300262928 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300271988 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300312042 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300319910 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300357103 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300371885 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300519943 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300529003 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300537109 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300544977 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300559998 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300568104 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300658941 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300667048 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300698996 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300806046 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300813913 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300822020 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300859928 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.300868988 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.333092928 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.338012934 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.400659084 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.405534029 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.442457914 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.447303057 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.552514076 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.557933092 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.661190033 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.666150093 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.744055033 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.768054008 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.769762993 CET	49708	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.770484924 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.774662971 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.775352955 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.872014999 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.877079010 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877093077 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877173901 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877212048 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877346992 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877355099 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877434015 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877450943 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877557039 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877564907 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877614975 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877623081 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877656937 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877665997 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877710104 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877724886 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877830029 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877839088 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877877951 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877887011 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877928972 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.877945900 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878031969 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878041029 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878082991 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878091097 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878226995 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878241062 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878249884 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878257990 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878273964 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878282070 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878343105 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878350973 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878405094 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878412962 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878462076 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878469944 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878547907 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878551960 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878606081 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878616095 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878673077 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878680944 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878746033 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878753901 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878807068 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.878814936 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.880404949 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.885224104 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:27.989057064 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:27.994108915 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.098526955 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.103303909 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.207843065 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.212682962 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.317305088 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.322221041 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.426620960 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.431632042 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.525460958 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.535890102 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.540760994 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.645657063 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.650609016 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.651865005 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.656900883 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.656910896 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.656992912 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657011032 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657026052 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657033920 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657094955 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657103062 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657177925 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657185078 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657290936 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657299042 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657367945 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657376051 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657435894 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657444000 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657558918 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657567024 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657604933 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657650948 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657699108 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657706976 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657767057 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657774925 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657825947 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657833099 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657938004 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.657946110 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658010960 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658018112 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658082008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658088923 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658139944 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658148050 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658200979 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658209085 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658257961 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658265114 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658329964 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658337116 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658397913 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658405066 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658462048 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658468008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658531904 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658539057 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658587933 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.658646107 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.754995108 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.760066986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.864545107 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.871437073 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:28.973670959 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:28.979398012 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.082966089 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:29.088124037 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.102691889 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.145075083 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:29.192939043 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:29.241169930 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:29.343319893 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.343868971 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.343879938 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.343997955 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344089031 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344098091 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344130039 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344139099 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344185114 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344253063 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344261885 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344293118 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344398022 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344405890 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344446898 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344455004 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344504118 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344512939 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344547987 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344590902 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344681978 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344691992 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344747066 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344754934 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344827890 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344835997 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344870090 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344877958 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344893932 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344902992 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.344963074 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345012903 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345068932 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345077991 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345124006 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345170975 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345268965 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345277071 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345407963 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345417023 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345463991 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345472097 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345515013 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345524073 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345556021 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345597029 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345654964 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345664024 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.345671892 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.346343040 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:29.351355076 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.457743883 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:29.462686062 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.567575932 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:29.572720051 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.686372042 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:29.691409111 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.832350969 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:29.837222099 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.844387054 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:29.895214081 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.071362972 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.120855093 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.129511118 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.134586096 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.134596109 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.134680986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.134689093 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.134810925 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.134835958 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.134918928 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.134960890 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135000944 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135082006 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135133028 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135211945 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135243893 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135328054 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135337114 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135401011 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135409117 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135510921 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135519981 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135566950 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135575056 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135669947 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135678053 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135721922 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135730028 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135771036 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135778904 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135795116 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135798931 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135816097 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135863066 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135870934 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135880947 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135919094 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135927916 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135977983 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.135986090 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136049986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136059046 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136075020 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136082888 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136092901 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136100054 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136143923 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136152983 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136223078 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136230946 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.136241913 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.187450886 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.192223072 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.301496029 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.306360006 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.411019087 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.415868998 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.520371914 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.525234938 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.623560905 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.629632950 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.635221958 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.739186049 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.744117975 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.752986908 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.757997990 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758018017 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758148909 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758240938 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758369923 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758378983 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758388996 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758424997 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758461952 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758471012 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758512974 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758521080 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758563042 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758569956 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758611917 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758619070 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758666992 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758673906 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758709908 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758717060 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758764982 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758771896 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758800030 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758806944 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758843899 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758894920 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758902073 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758908987 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758940935 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758949041 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758963108 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.758970022 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759016991 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759025097 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759051085 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759057999 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759120941 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759128094 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759160042 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759166956 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759202003 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759247065 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759253979 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.759295940 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.848334074 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.853740931 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:30.957740068 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:30.962579966 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.067099094 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.071922064 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.176503897 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.181358099 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.269606113 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.285912991 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.290884018 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.375349998 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.380302906 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380333900 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380353928 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380459070 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380466938 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380507946 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380549908 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380558968 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380655050 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380707026 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380714893 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380778074 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380785942 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380835056 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380841970 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380867958 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380903959 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380956888 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380964994 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.380985975 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.381035089 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.381071091 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.381179094 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.405242920 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.410089970 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.520256996 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.525914907 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.629918098 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.634777069 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.739167929 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.744023085 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.848448992 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.942298889 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.951699018 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:31.961585045 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:31.966552019 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.059348106 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.064408064 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.064455986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.064507008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.064636946 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.064644098 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.064681053 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.064764023 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.064774036 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.064841986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.064964056 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065042019 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065078974 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065135002 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065232992 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065241098 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065269947 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065332890 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065340996 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065382004 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065413952 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065448999 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065514088 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065521002 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.065530062 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.069586039 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.074433088 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.176604986 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.181556940 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.286076069 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.290915012 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.398452997 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.414383888 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.486675978 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.521100998 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.526029110 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.654793024 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.659720898 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.806963921 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.812063932 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812074900 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812083960 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812098980 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812105894 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812148094 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812197924 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812216997 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812237978 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812313080 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812357903 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812366962 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812438011 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812446117 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812489986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812565088 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812619925 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812639952 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812654972 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812706947 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.812721968 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.813235044 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.815802097 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.820579052 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:32.926630020 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:32.931615114 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.051712990 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.056719065 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.160980940 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.165923119 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.241667032 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.272006989 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.277787924 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.387490988 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.392425060 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.392476082 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.397502899 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.397586107 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.397712946 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.397780895 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.397816896 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.397862911 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.397907972 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.397988081 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.397995949 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398029089 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398121119 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398128986 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398137093 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398194075 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398256063 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398327112 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398382902 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398432016 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398500919 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398545980 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398602009 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398663998 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398711920 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398745060 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.398811102 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.489089012 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.494111061 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.598500967 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.603460073 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.707989931 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.713243008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.810106039 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.817486048 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.822443962 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.911228895 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.916503906 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916517019 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916595936 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916613102 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916649103 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916683912 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916728020 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916795969 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916882992 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916891098 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916919947 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916944981 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.916981936 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917016029 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917037010 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917083979 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917102098 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917151928 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917169094 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917202950 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917242050 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917305946 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917356014 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.917363882 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:33.926423073 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:33.931258917 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.036202908 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.041249037 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.146958113 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.152009010 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.254842043 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.260188103 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.351911068 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.364119053 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.369086981 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.476489067 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.482687950 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.482701063 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.482758999 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.482907057 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.482914925 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483038902 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483047009 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483055115 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483190060 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483197927 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483206987 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483359098 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483366966 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483376026 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483525991 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483656883 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483665943 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483673096 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483680964 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483807087 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483814955 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483823061 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483975887 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.483984947 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.484146118 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.491133928 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.598428011 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.604275942 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.707865000 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.712924957 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.817264080 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.822285891 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.895565033 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:34.926610947 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:34.931514025 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.036541939 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:35.041621923 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.050568104 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:35.055507898 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.055551052 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.055624008 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.055635929 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.055697918 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.055772066 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.055856943 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.055933952 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.055982113 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056037903 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056081057 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056135893 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056149960 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056247950 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056260109 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056273937 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056391001 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056404114 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056425095 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056437016 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056451082 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056509018 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056548119 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.056560993 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.146759987 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:35.151755095 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.255415916 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:35.260318041 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.364293098 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:35.369702101 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.630063057 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:35.635020971 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.704296112 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.741569042 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:35.746550083 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:35.935389996 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:35.990183115 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.003133059 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003150940 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003161907 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003176928 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003187895 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003199100 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003223896 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003242970 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003254890 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003268003 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003326893 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003340960 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003349066 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003380060 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003439903 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003451109 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003489971 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003547907 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003608942 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003624916 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003639936 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003751040 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003762007 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003772974 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003794909 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003815889 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003854990 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003909111 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.003989935 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.004038095 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.004106998 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.004120111 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.054959059 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.059886932 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.163475990 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.168626070 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.293378115 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.298438072 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.396291018 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.401242018 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.504955053 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.509932995 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.580738068 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.618355036 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.623333931 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.678246975 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.683341026 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.683361053 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.683409929 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.683589935 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.683717966 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.683727026 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.723428965 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.728387117 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.832962036 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.837995052 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:36.942369938 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:36.952553988 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.051527977 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.056500912 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.160950899 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.164644003 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.166335106 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.201457977 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.206461906 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.206481934 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.206517935 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.206679106 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.206762075 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.206770897 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.270879984 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.275774956 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.379703999 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.384584904 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.489142895 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.494206905 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.584395885 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.598468065 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.603301048 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.649342060 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.654468060 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.654506922 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.654566050 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.654633999 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.654709101 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.654762030 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.707833052 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.712862968 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.817183018 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.822185993 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:37.926557064 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:37.932482958 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.036043882 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.041297913 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.077734947 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.104856968 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.109857082 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.109888077 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.109901905 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.110160112 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.110263109 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.110276937 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.145350933 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.191277027 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.267937899 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.272845984 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.448245049 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.453319073 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.606935978 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.607569933 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.611876011 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.660706043 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.681654930 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.686718941 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.686752081 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.686773062 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.686885118 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.686989069 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.687001944 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.756241083 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.761249065 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.864022970 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.869172096 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:38.973381996 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:38.978332996 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.082747936 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.087680101 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.192207098 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.197174072 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.222201109 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.263796091 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.268732071 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.268759966 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.268771887 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.268944025 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.269006968 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.269020081 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.301558018 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.355284929 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.411056042 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.416017056 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.520236969 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.525206089 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.630563021 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.635581970 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.642270088 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.684724092 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.689815998 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.689846039 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.689899921 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.690119028 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.690170050 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.690200090 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.739228964 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.791340113 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.855844975 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.860845089 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:39.958405018 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:39.963462114 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.061522961 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.067363977 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:40.072309971 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.116306067 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:40.121416092 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.121450901 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.121489048 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.121599913 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.121644020 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.121665955 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.176632881 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:40.181634903 CET	6073	49711	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.182049990 CET	6073	49708	147.185.221.25	192.168.2.8
Jan 10, 2025 11:03:40.211983919 CET	49706	80	192.168.2.8	208.95.112.1
Jan 10, 2025 11:03:40.212012053 CET	49711	6073	192.168.2.8	147.185.221.25
Jan 10, 2025 11:03:40.212027073 CET	49708	6073	192.168.2.8	147.185.221.25

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 11:03:05.409245968 CET	58991	53	192.168.2.8	1.1.1.1
Jan 10, 2025 11:03:05.417390108 CET	53	58991	1.1.1.1	192.168.2.8
Jan 10, 2025 11:03:07.033301115 CET	53680	53	192.168.2.8	1.1.1.1
Jan 10, 2025 11:03:07.040185928 CET	53	53680	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 11:03:05.409245968 CET	192.168.2.8	1.1.1.1	0xe7f0	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:03:07.033301115 CET	192.168.2.8	1.1.1.1	0x1fac	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 11:03:05.417390108 CET	1.1.1.1	192.168.2.8	0xe7f0	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:03:07.040185928 CET	1.1.1.1	192.168.2.8	0x1fac	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:03:07.040185928 CET	1.1.1.1	192.168.2.8	0x1fac	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Jan 10, 2025 11:03:07.040185928 CET	1.1.1.1	192.168.2.8	0x1fac	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	208.95.112.1	80	3672	C:\Users\user\Desktop\XClient.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 11:03:05.430852890 CET	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jan 10, 2025 11:03:05.886295080 CET	175	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:03:05 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	104.20.4.235	443	3672	C:\Users\user\Desktop\XClient.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 10:03:07 UTC	74	OUT	GET /raw/76WgDu7L HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2025-01-10 10:03:07 UTC	388	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 10:03:07 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Fri, 10 Jan 2025 10:03:07 GMT Server: cloudflare CF-RAY: 8ffbd5dcba8d8c4d-EWR
2025-01-10 10:03:07 UTC	25	IN	Data Raw: 31 33 0d 0a 31 34 37 2e 31 38 35 2e 32 32 31 2e 32 35 3a 36 30 37 33 0d 0a Data Ascii: 13147.185.221.25:6073
2025-01-10 10:03:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	05:03:00
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\XClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\XClient.exe"
Imagebase:	0x330000
File size:	74'240 bytes
MD5 hash:	F814BC67769270C774B0FC4DBA88CA5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1401314764.0000000000332000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1401314764.0000000000332000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1787449810.00000000025C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1787449810.0000000002571000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:03:17
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\Update.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Update.exe"
Imagebase:	0x630000
File size:	74'240 bytes
MD5 hash:	F814BC67769270C774B0FC4DBA88CA5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Joe Security Rule: rat_win_xworm_v3, Description: Finds XWorm (version XClient, v3) samples based on characteristic strings, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: Sekoia.io Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\Update.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 74%, ReversingLabs Detection: 68%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:03:26
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Roaming\Update.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\Update.exe"
Imagebase:	0x5f0000
File size:	74'240 bytes
MD5 hash:	F814BC67769270C774B0FC4DBA88CA5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	05:03:38
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp4450.tmp.bat""
Imagebase:	0x7ff7bb210000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:03:38
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:03:38
Start date:	10/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout 3
Imagebase:	0x7ff61d470000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	24.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFB4B03C248 Relevance: 2.4, Strings: 1, Instructions: 1153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFB4B03CD54

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 762d6b2eb46dd86bc8378b9335d591a8c284e5aa698681256329f60a00c99c81
Instruction ID: a482bc2147d6a2d2d9b37459d255535bf4503100bc9b3969d40a354ad83cb4c5
Opcode Fuzzy Hash: 762d6b2eb46dd86bc8378b9335d591a8c284e5aa698681256329f60a00c99c81
Instruction Fuzzy Hash: 3682A2B1A1CA0A8FE694FF38C49A67973D2EF89311F549579D50EC32D3DE28AC028745

Function 00007FFB4B0316C9 Relevance: 1.9, Strings: 1, Instructions: 632
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SAN_^, xrefs: 00007FFB4B031905

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID:
String ID: SAN_^
API String ID: 0-3629432999
Opcode ID: cefea022863868ee88dccfc105799cce077a9bbaba326b8d425b1c5e84e78d70
Instruction ID: 701ee73e28b7bca47217abe49c648117ce0a0e7228995233f9aacc8737fecdea
Opcode Fuzzy Hash: cefea022863868ee88dccfc105799cce077a9bbaba326b8d425b1c5e84e78d70
Instruction Fuzzy Hash: FC12D4B1B2DA494FE799FF38C4A927976D2FF88301F4445B9E44EC3392DE28A8418745

Function 00007FFB4B037881 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FFB4B037930

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 6cf37376d831ba70b293578b19149da0797bf94f49144c7e2d53e6085db8e1db
Instruction ID: e849b6ad4fb8a5572632693f14927ef864c290dca5f30c6c1b0814b6cd9a2d01
Opcode Fuzzy Hash: 6cf37376d831ba70b293578b19149da0797bf94f49144c7e2d53e6085db8e1db
Instruction Fuzzy Hash: 8D31247190C75C8FCB59DF68C84ABE97BE0EF65321F04426BD489D7252DB34A806CB91

Function 00007FFB4B03DADA Relevance: 1.1, Instructions: 1065
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70a7436bf676729eb7a231c6d83798e00d28636bdf62dcc0c6c12ec6da5f6143
Instruction ID: 87a29d54146c41f7201c05dc9754169d3a8f2d586fab09bc048620e1b847fac5
Opcode Fuzzy Hash: 70a7436bf676729eb7a231c6d83798e00d28636bdf62dcc0c6c12ec6da5f6143
Instruction Fuzzy Hash: A36207B1B1CA058BE744FF38C49A279B7D2FF99301F5446BAD80DC7392DE28A8418756

Function 00007FFB4B03FAB9 Relevance: .6, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c68b35a819fc90da415d385d8255389d3b18961a167524088a4c7b443236ae
Instruction ID: 454d6e7834ea7680df2bfdeb54f71986834af754423e51bc67e73e3acd9266fc
Opcode Fuzzy Hash: 79c68b35a819fc90da415d385d8255389d3b18961a167524088a4c7b443236ae
Instruction Fuzzy Hash: EC1282B190991D8FDB98EF68C898BA877F1FF59311F4041B9D04DD32A2DE34A985CB50

Function 00007FFB4B035EC6 Relevance: .5, Instructions: 473
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3dbffe2e8d512274a7b0c3620b60db140cf224a29a70b9b400901250eafb544
Instruction ID: 4a06d4db30ac5eb2275f17c642ea25749aa3a272249cbb7894e4b48f0b9e06be
Opcode Fuzzy Hash: b3dbffe2e8d512274a7b0c3620b60db140cf224a29a70b9b400901250eafb544
Instruction Fuzzy Hash: ABF1B57190CA8D8FEBA9EF28C8557E977E1FF54311F04826EE84DC7291DB34A8458B81

Function 00007FFB4B036C72 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 214c8476d2af0f5443d9b75dce0e249f3a68807adb8ef1dc76e7f7bef2788ac0
Instruction ID: 2d61e699e1e44637bb0244d766aa68defb30a36cda5d93820bc15b10d3e150d7
Opcode Fuzzy Hash: 214c8476d2af0f5443d9b75dce0e249f3a68807adb8ef1dc76e7f7bef2788ac0
Instruction Fuzzy Hash: 50E1C37190CA4D8FEBA9EF28C8597E977E1EF54311F04826ED84DC7291CE74A8458B81

Function 00007FFB4B031F0D Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d7bbfdadfd5e5004b9cc5c5087c2dc88825bacb11b99ca8774d3b6488e56828
Instruction ID: 62117ffdcb416e94d641fc79e464fc291f10b0b21a4785a2828e3a2cb9692d43
Opcode Fuzzy Hash: 9d7bbfdadfd5e5004b9cc5c5087c2dc88825bacb11b99ca8774d3b6488e56828
Instruction Fuzzy Hash: CF51D191A1E6C54FD786AB7888692757FD5DF8B216B0800FFE0C9C72E3DE18580AC346

Function 00007FFB4B03EDB5 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2464dd2a0f35331fbeb84c69f4915f2794b1dd753877e938f8a6b1c0a8e2ccb9
Instruction ID: 11d9f80170bc4dcf046ac1397b73b3e5d623b94c5f4630b2e0359b1c7a67f7d6
Opcode Fuzzy Hash: 2464dd2a0f35331fbeb84c69f4915f2794b1dd753877e938f8a6b1c0a8e2ccb9
Instruction Fuzzy Hash: B651E7B0D18A0D8FDB98EF68C495AACB7F1FF59301F105569D00EE72A2CB75A881CB44

Function 00007FFB4B03C0B0 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e662184506cdfa09d0d00b55a3f535fbf6273a946c62aaa786118b3a9865ee
Instruction ID: 62a42be6db02e129742b29caedd20f644fb960d2da9a591e818793752b348989
Opcode Fuzzy Hash: 84e662184506cdfa09d0d00b55a3f535fbf6273a946c62aaa786118b3a9865ee
Instruction Fuzzy Hash: A7512770D0862D8EEBA9EF78C5546FDB3B1EF49301F108579D10EE32A2DA386954CB44

Function 00007FFB4B03974D Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFB4B039822

Memory Dump Source

Source File: 00000000.00000002.1789684360.00007FFB4B030000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffb4b030000_XClient.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: 4c7c49977afcb5878d805ffdc045a15c95705642dddae59db757f7f213e1cfcc
Instruction ID: 8629daab1a00ad7ac3c69b7962ff61aba91e3cd7142516e35c29c7ef0b7abd6b
Opcode Fuzzy Hash: 4c7c49977afcb5878d805ffdc045a15c95705642dddae59db757f7f213e1cfcc
Instruction Fuzzy Hash: 6141D47190C6588FD719DFA8D849AE9BBF0FF56311F04416FD08AC3692CB746846CB91

Analysis Process: Update.exePID: 2976, Parent PID: 4084COMMON

Executed Functions

Function 00007FFB4B050FE8 Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4386b8ad0dd6ca215c42c9b14bb53d649638436746cde50100e19532a1778f19
Instruction ID: b6782f4602ede9ffd88ee4b20d6425afef0a75686392bf40be1e0e0362bf0e9c
Opcode Fuzzy Hash: 4386b8ad0dd6ca215c42c9b14bb53d649638436746cde50100e19532a1778f19
Instruction Fuzzy Hash: E5A1D4E3A0E6664AE302BBBCF4614F97F64DF43335B0845B7D58D8A1A3DD18204786E9

Function 00007FFB4B0516C9 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2dfa0f5df507bcdc663c255dd0d5eb63e82e39a492c29df7c112bc80936e7c6
Instruction ID: 4663c0cde29afe17f1a3a1dd95e68bbcae4c8f5c1aeb67c9fd2483200b623ef6
Opcode Fuzzy Hash: d2dfa0f5df507bcdc663c255dd0d5eb63e82e39a492c29df7c112bc80936e7c6
Instruction Fuzzy Hash: 2312D3B0B1CA098FE799FF38C4696B976D2EF89301F4445B9E44EC37D2DE28A8418751

Function 00007FFB4B051F0D Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4600fbc23ee49a0713a9e8e6914867853ae1fac4c872384b7f7d9aad7a439b1d
Instruction ID: 3b07f3f25a866e08b3bf1d2abfda55aedefe7c3ebd51e3a3eb33ae38d0bd2aff
Opcode Fuzzy Hash: 4600fbc23ee49a0713a9e8e6914867853ae1fac4c872384b7f7d9aad7a439b1d
Instruction Fuzzy Hash: 4151DE90A1E6C94FD786AB7888256757FD5DF8721AB0804FAE0C9C72A3DE18580AC352

Function 00007FFB4B0509FA Relevance: 1.6, Strings: 1, Instructions: 323COMMON

Download Yara Rule

Strings

:L_^, xrefs: 00007FFB4B050A01

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID: :L_^
API String ID: 0-1990364693
Opcode ID: d5aa3dda4a19d7db36b45e1063a0b7359380952fc1d92476c08efb40886d6a4e
Instruction ID: e54e8350746a2f02042f9e52dde2f043f129071c43dbba339f093afd20581993
Opcode Fuzzy Hash: d5aa3dda4a19d7db36b45e1063a0b7359380952fc1d92476c08efb40886d6a4e
Instruction Fuzzy Hash: 19A138E6B0D6168AE702BFBCE4515FC3BA0EF86322B0445B7C549C62A3DD286046C3E5

Function 00007FFB4B0509F8 Relevance: 1.5, Strings: 1, Instructions: 283COMMON

Download Yara Rule

Strings

:L_^, xrefs: 00007FFB4B050A01

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID: :L_^
API String ID: 0-1990364693
Opcode ID: 5adf9c03997c231862234833230f76144a169a7cba764e7cb3a0c821f35bd4d6
Instruction ID: 0aec67bdb4eece94725f742c7dfa64e22b3da44d8e8eba70fa3d40adf5d4fde3
Opcode Fuzzy Hash: 5adf9c03997c231862234833230f76144a169a7cba764e7cb3a0c821f35bd4d6
Instruction Fuzzy Hash: D78126E6B0DA168AE702BFBCE4615FC3BA0EF86321B0445B7D549C62D3DD286446C3E4

Function 00007FFB4B0510E2 Relevance: .6, Instructions: 640COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2d4de51caf291b4ae6fef0fd46f1768ef0ebfa7db2f45b3a7466aa117a3a5fa
Instruction ID: 37ab4e1a44787cde4e85d2e8777b96b33bda4e5157b627246eb44838ff3ac1db
Opcode Fuzzy Hash: f2d4de51caf291b4ae6fef0fd46f1768ef0ebfa7db2f45b3a7466aa117a3a5fa
Instruction Fuzzy Hash: EB7129E3A0D6564AD702FBBCE4A14F97F74EF43325B0445B7D14D891B3DD18244686E8

Function 00007FFB4B0510D3 Relevance: .6, Instructions: 626COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75937e858562b10fbf300bdca21d16c1f0e9c9312a18842b6177ad525e8b2a70
Instruction ID: 81b83a70913d1799cf701a8df1b3d642d7616e1c332a39f08952f84789924781
Opcode Fuzzy Hash: 75937e858562b10fbf300bdca21d16c1f0e9c9312a18842b6177ad525e8b2a70
Instruction Fuzzy Hash: A06108E3E0D6564AE702FBBCE4A14F97F70EF43325B0445B7D6898A1B3DD18244686D8

Function 00007FFB4B0511E2 Relevance: .5, Instructions: 536COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c55cc239fcac064a18796e8c57957a0c9e6b30d5f7c30a14c5af89977e104b
Instruction ID: ec7d73144d8a4f9d006347624c23731e632f9b6053f1b5a05421b5d767ff5caf
Opcode Fuzzy Hash: 26c55cc239fcac064a18796e8c57957a0c9e6b30d5f7c30a14c5af89977e104b
Instruction Fuzzy Hash: 924107E2D0E7964BD702FBBCD4B14F97FB0EF03224B4845F7D1898A1A3DD1864468698

Function 00007FFB4B0511D7 Relevance: .5, Instructions: 527COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c24ce4b15400444be1cb7d65e38267be089096ab0659d6156317a5c828db2d8
Instruction ID: c906b19f36ac97b0d35f380130ad5c642f53e2a0d54168f799deb5a864c22c53
Opcode Fuzzy Hash: 8c24ce4b15400444be1cb7d65e38267be089096ab0659d6156317a5c828db2d8
Instruction Fuzzy Hash: BA4114E2D0DA5A4FD702FBBCD8A24FA7FB0EF52225B4444B6C189C62A3DD1864468694

Function 00007FFB4B050AD3 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3326412b3c8c796cd9898154259c998f16c603b51b656ac9de7cc02df0d272d5
Instruction ID: 01cedc7cf4288d7fffef66871e36e818d5e18de73706a6db94a1d9dc050743af
Opcode Fuzzy Hash: 3326412b3c8c796cd9898154259c998f16c603b51b656ac9de7cc02df0d272d5
Instruction Fuzzy Hash: B05139B5B19A1A8EE702FB7CE4516FC3BA1EF86311B4445BBC408C7293DD286446C7E0

Function 00007FFB4B050E3E Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 967907e8c690c6f9212e246dd07351eb5bb1607b6a68081401ecce44aed56ed0
Instruction ID: 46525fc205dc87e15369a63b0da25459113fef1df6fe335a34053509f16e2b1a
Opcode Fuzzy Hash: 967907e8c690c6f9212e246dd07351eb5bb1607b6a68081401ecce44aed56ed0
Instruction Fuzzy Hash: 7251D4A1B0E6860FE357BB78D8655B93FD1DF8722170940FBD489C76A3DC1898468362

Function 00007FFB4B050620 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0aad966f772d09777f4d25a2373281534f763ad7a6c41776406c0436d90b0b
Instruction ID: dcdca5cd66e7df8db5c6bf4866a6564695b77228985a4e47550e08e73b34b592
Opcode Fuzzy Hash: db0aad966f772d09777f4d25a2373281534f763ad7a6c41776406c0436d90b0b
Instruction Fuzzy Hash: 4231C061B1D9490FE788FA3CD85A779B6C2EF99215F0401BEE44EC32D3DE689C028385

Function 00007FFB4B050CD1 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5b645652943c750d11ddc83d6b3febe65512572d54714b09e3dd50c4ac3485
Instruction ID: e72706216045e591d99abf1c19eb26def4231463bdccd57902964d8fbcd8094b
Opcode Fuzzy Hash: 9d5b645652943c750d11ddc83d6b3febe65512572d54714b09e3dd50c4ac3485
Instruction Fuzzy Hash: 033187E1B19A054FE745FBBCD85A7BC77D1EF99301F1441BAE40DC3692ED2898018762

Function 00007FFB4B0520C1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1608314719.00007FFB4B050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffb4b050000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f188febd3caf7041aa449366ecb4f58351d03f766050ee34f155c6490587ff8a
Instruction ID: 6fd8b5a5ce5e6d697ffbd127e0b6f3231da9370ccf0963bf63c716b9944c4a4c
Opcode Fuzzy Hash: f188febd3caf7041aa449366ecb4f58351d03f766050ee34f155c6490587ff8a
Instruction Fuzzy Hash: 9901F99491D7854FE796BB3898654767FE0DF92241B0804FBD984C72A7EC089984C3A2

Analysis Process: Update.exePID: 4640, Parent PID: 4084COMMON

Executed Functions

Function 00007FFB4B040FE8 Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af69086d7b3d59bcd817e4eb470b267df4819642c3a30c9cdcd349289f855ed4
Instruction ID: c0d3fa42760513627a2159231b03d4df7eed73183b180d555599fcbc708e1b57
Opcode Fuzzy Hash: af69086d7b3d59bcd817e4eb470b267df4819642c3a30c9cdcd349289f855ed4
Instruction Fuzzy Hash: B0A1E8E7E0E6664AE706BBB8F4610F93F64DF43335B0845B7D58D8A1A3DD48244682A8

Function 00007FFB4B0416C9 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7578e5bab44a7d07be54f3e995ec6869c08c5aede2890d6d1ab9229622698955
Instruction ID: 1f63f0a3bfd7707a9c0ea8328716828fda857c7cf91978775e92239893c2b94b
Opcode Fuzzy Hash: 7578e5bab44a7d07be54f3e995ec6869c08c5aede2890d6d1ab9229622698955
Instruction Fuzzy Hash: 2B12D4B0B1CA594FE799FB38C4692797AD2EF88301F4445BDE40EC33D2DE28A8458751

Function 00007FFB4B041F0D Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94f046547fa23a7685c46fa7e98c60010935ae6721df421f7b963f5c6465fd2b
Instruction ID: 76fc4815c21874a79b4a5b53f0b3d3eb51954c29dec495e8323643e5bfaf8d3b
Opcode Fuzzy Hash: 94f046547fa23a7685c46fa7e98c60010935ae6721df421f7b963f5c6465fd2b
Instruction Fuzzy Hash: E651D090A1E6C94FD78AAB7888252757FD5DF87216B0801FEE4C9C72E3DE185C0AC356

Function 00007FFB4B0409FA Relevance: 1.6, Strings: 1, Instructions: 329COMMON

Download Yara Rule

Strings

:M_^, xrefs: 00007FFB4B040A01

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID: :M_^
API String ID: 0-2002838562
Opcode ID: 41f6cd20224f72c4b6f6d532cf7c31181b1cf6dd4daa1787efcc08c651160f9e
Instruction ID: 21145691b88605374b37709a8307dddf2116c394db853640c7ec969cb8c0a502
Opcode Fuzzy Hash: 41f6cd20224f72c4b6f6d532cf7c31181b1cf6dd4daa1787efcc08c651160f9e
Instruction Fuzzy Hash: 7E912AF6B0D66A8AE705BB7CE4111FC7BA0EF86326B0446B7D549C6283DD68604683A4

Function 00007FFB4B0409F8 Relevance: 1.5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

Strings

:M_^, xrefs: 00007FFB4B040A01

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID: :M_^
API String ID: 0-2002838562
Opcode ID: eb6db186e36e4fb02b26ae2a0635653bd896cd7d91d31f0a315e70f2f853962b
Instruction ID: e8e0328659c4d9efc4ccf95c2bb299277a4020f339d676cc3c0d11da3d54ccd5
Opcode Fuzzy Hash: eb6db186e36e4fb02b26ae2a0635653bd896cd7d91d31f0a315e70f2f853962b
Instruction Fuzzy Hash: FF814AF6B0D62A8AE705BB7CE4251FC7BA1EF86325F0446B7D508C62C3DD28604683E4

Function 00007FFB4B0410E2 Relevance: .6, Instructions: 650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55e3bd896fd96e77b5bb973429f0278db0cd0a15c6bf7e5a1b950accb619bdc3
Instruction ID: b9563cc9ce2cdad6f91f3dea497edd8bad836c738c496d76cbffc477c694b4f2
Opcode Fuzzy Hash: 55e3bd896fd96e77b5bb973429f0278db0cd0a15c6bf7e5a1b950accb619bdc3
Instruction Fuzzy Hash: 6E7119E7E0E67A4AE715BBBCE4610F97F60EF43331B0841B7D589891A3DD18244686D4

Function 00007FFB4B0410D3 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ad2a484e4be8be4e1d2331d571c73d7fdae82d5bb9a78104590df8f82f2015
Instruction ID: cdef72df9fd879cd530f41c22e3446f5fba2b174bae31bd3be28c485cb283a3b
Opcode Fuzzy Hash: c2ad2a484e4be8be4e1d2331d571c73d7fdae82d5bb9a78104590df8f82f2015
Instruction Fuzzy Hash: 947109E7E0E67A4AE706BBBCE5A10F97F70EF43321B0441B7D5898A1E3DD18244686D4

Function 00007FFB4B0411E2 Relevance: .5, Instructions: 544COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e81a47c92530fd155eb80cdbcbd3d172dd73f70ba3d3c2c05d54e47e4641e73
Instruction ID: 8b284786a92a3baaaebee36f6f219490126c931cb618e1bcbf78f9f48e07a382
Opcode Fuzzy Hash: 2e81a47c92530fd155eb80cdbcbd3d172dd73f70ba3d3c2c05d54e47e4641e73
Instruction Fuzzy Hash: C141F9E7D0E6AA4BD705BBBCE4B10F97FB0EF06220B0845F7D4C98A1A3DD1864468794

Function 00007FFB4B0411D7 Relevance: .5, Instructions: 534COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc5a4e7350f9eb87ad527c458966cbc520ffa9de6f6c28ce7632041ae8359d5
Instruction ID: df45b1680f14c022cc549a75712432d05717d38b5ac45c119a43c88a3b5d6a53
Opcode Fuzzy Hash: fcc5a4e7350f9eb87ad527c458966cbc520ffa9de6f6c28ce7632041ae8359d5
Instruction Fuzzy Hash: 8F4106E7D0D6AA4FE705BBBCD4B10FA7FA0EF46221B0441B7D589CA1A3DD1864068794

Function 00007FFB4B040AD3 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831c34ea887d11e27626568cfa828e6c468b93675ef23ad9307f739a3640dbff
Instruction ID: 71c37026b2899973db2c66869af6d47cec5a3b3d1dcc2fcd59bcabfbee825d9d
Opcode Fuzzy Hash: 831c34ea887d11e27626568cfa828e6c468b93675ef23ad9307f739a3640dbff
Instruction Fuzzy Hash: 21514AB6B1DA698EE705BB7CE4512FC3BA1EF86315B0446BBD408C7283CD686446C7A0

Function 00007FFB4B040E3E Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68c5101bf5ad06244d8107e3926912b1497e4fdac7cf462ff18b94caeeef6ef
Instruction ID: 7718e0cf2308ce3eab54f80a8785521aa48a92707d30b40a40da60382f66b54d
Opcode Fuzzy Hash: e68c5101bf5ad06244d8107e3926912b1497e4fdac7cf462ff18b94caeeef6ef
Instruction Fuzzy Hash: F151F4A1B0E6960FE356B778D4551B53FD1DF8722170941FBD889CB2A3DC0898478362

Function 00007FFB4B040620 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1db23d17ad32cee2084b646dc4b7a1483fb28206725b76762bdbb2b21839cd97
Instruction ID: 68da0bd90bcc4f1a743f17f34d263a5ef88da2cf392f5de0f60eae672bf9c102
Opcode Fuzzy Hash: 1db23d17ad32cee2084b646dc4b7a1483fb28206725b76762bdbb2b21839cd97
Instruction Fuzzy Hash: 0D31C561B1D9490FE788BA3CD85A378B6C2EF99211F0401BEE44EC32D3DE589C068344

Function 00007FFB4B040CD1 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b788f687794d998d4fda382fe2b150f8ce18a5ec8f5d4ec06b3d9b65ca1c249
Instruction ID: fa3feae5162ecc44127cd94e7cd41049e57674fe44429b04093beb8fad53f49e
Opcode Fuzzy Hash: 4b788f687794d998d4fda382fe2b150f8ce18a5ec8f5d4ec06b3d9b65ca1c249
Instruction Fuzzy Hash: 3A3187E1B19A194FE745BBBCD8593BD7BD1EF99301F0442BAE40DC7293DD28A8024751

Function 00007FFB4B0420C1 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1691646318.00007FFB4B040000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFB4B040000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffb4b040000_Update.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 938e9ad70615f9a2d0bf445773309788744a3f832fc42cab51f657469acb8839
Instruction ID: 28b1aedda24372dc2c54df3e210f3f451f250d401d34ed6cc2de4684704e3081
Opcode Fuzzy Hash: 938e9ad70615f9a2d0bf445773309788744a3f832fc42cab51f657469acb8839
Instruction Fuzzy Hash: 3F012B95A2D7D10FF79A7B3898654717FE09F96241B0804AAE8C4C71B7D8089984C392

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XClient.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\XClient.exe.log

C:\Users\user\AppData\Local\Temp\tmp4450.tmp.bat

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Update.lnk

C:\Users\user\AppData\Roaming\Update.exe

\Device\Null

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
XClient.exe

Function 00007FFB4B03C248 Relevance: 2.4, Strings: 1, Instructions: 1153
COMMON

Function 00007FFB4B0316C9 Relevance: 1.9, Strings: 1, Instructions: 632
COMMON

Function 00007FFB4B037881 Relevance: 1.6, APIs: 1, Instructions: 124
COMMON

Function 00007FFB4B03DADA Relevance: 1.1, Instructions: 1065
COMMON

Function 00007FFB4B03FAB9 Relevance: .6, Instructions: 565
COMMON

Function 00007FFB4B035EC6 Relevance: .5, Instructions: 473
COMMON

Function 00007FFB4B03974D Relevance: 1.6, APIs: 1, Instructions: 143
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre