Edit tour

Windows Analysis Report
bUrP.exe

Overview

General Information

Sample name:	bUrP.exe
Analysis ID:	1415997
MD5:	8cc1d92a748e389e44e4d2757e0c276f
SHA1:	314bf49942c9576ec1e6237985a770a891c91380
SHA256:	1e5a837d5e69be8d6e3eb8143e4d96204b5116b5426df20acd769506ab4b3d6f
Tags:	exexworm
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Potentially Suspicious Malware Callback Communication

Uses dynamic DNS services

Allocates memory with a write watch (potentially for evading sandboxes)

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

bUrP.exe (PID: 7576 cmdline: "C:\Users\user\Desktop\bUrP.exe" MD5: 8CC1D92A748E389E44E4D2757E0C276F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["dzn.ddns.net"], "Port": "5552", "Aes key": "<123456789>", "Install file": "USB.exe", "Version": "XWorm V3.1"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bUrP.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
bUrP.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x637e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x641b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6530:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x61ee:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x617e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x621b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6330:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x5fee:$cnc4: POST / HTTP/1.1
Process Memory Space: bUrP.exe PID: 7576	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.bUrP.exe.580000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.bUrP.exe.580000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x637e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x641b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x6530:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x61ee:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 191.233.27.50, DestinationIsIpv6: false, DestinationPort: 5552, EventID: 3, Image: C:\Users\user\Desktop\bUrP.exe, Initiated: true, ProcessId: 7576, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49729

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: bUrP.exe

Avira: detected

Antivirus detection for URL or domain

Source: dzn.ddns.net

Avira URL Cloud: Label: malware

Found malware configuration

Source: bUrP.exe

Malware Configuration Extractor: Xworm {"C2 url": ["dzn.ddns.net"], "Port": "5552", "Aes key": "<123456789>", "Install file": "USB.exe", "Version": "XWorm V3.1"}

Multi AV Scanner detection for submitted file

Source: bUrP.exe

ReversingLabs: Detection: 76%

Machine Learning detection for sample

Source: bUrP.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: bUrP.exe	String decryptor: dzn.ddns.net
Source: bUrP.exe	String decryptor: 5552
Source: bUrP.exe	String decryptor: <123456789>
Source: bUrP.exe	String decryptor: <Xwormmm>
Source: bUrP.exe	String decryptor: USB.exe

Source: bUrP.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: bUrP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: dzn.ddns.net

Uses dynamic DNS services

Source: unknown

DNS query: name: dzn.ddns.net

Source: global traffic

TCP traffic: 192.168.2.4:49729 -> 191.233.27.50:5552

Source: Joe Sandbox View

ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: dzn.ddns.net

System Summary

Malicious sample detected (through community Yara rule)

Source: bUrP.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.bUrP.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: bUrP.exe, 00000000.00000000.1618157418.000000000058A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs bUrP.exe
Source: bUrP.exe	Binary or memory string: OriginalFilenameXClient.exe4 vs bUrP.exe

Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: bUrP.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: bUrP.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.bUrP.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: bUrP.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: bUrP.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: bUrP.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@4/1

Source: C:\Users\user\Desktop\bUrP.exe	Mutant created: \Sessions\1\BaseNamedObjects\JD7Bbn5DlVw5Yl4J
Source: C:\Users\user\Desktop\bUrP.exe	Mutant created: NULL

Source: bUrP.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: bUrP.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\bUrP.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: bUrP.exe

ReversingLabs: Detection: 76%

Source: bUrP.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: bUrP.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: bUrP.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: bUrP.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: bUrP.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: bUrP.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: bUrP.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: bUrP.exe, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\bUrP.exe	Memory allocated: CB0000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe	Memory allocated: 1A8E0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\bUrP.exe

Window / User API: threadDelayed 9727

Jump to behavior

Source: C:\Users\user\Desktop\bUrP.exe TID: 7640	Thread sleep count: 234 > 30	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe TID: 7640	Thread sleep time: -234000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe TID: 7640	Thread sleep count: 9727 > 30	Jump to behavior
Source: C:\Users\user\Desktop\bUrP.exe TID: 7640	Thread sleep time: -9727000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\bUrP.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: bUrP.exe, 00000000.00000002.4066689460.0000000000B16000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllz

Source: C:\Users\user\Desktop\bUrP.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\bUrP.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\bUrP.exe

Queries volume information: C:\Users\user\Desktop\bUrP.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\bUrP.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: bUrP.exe, type: SAMPLE
Source: Yara match	File source: 0.0.bUrP.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bUrP.exe PID: 7576, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: bUrP.exe, type: SAMPLE
Source: Yara match	File source: 0.0.bUrP.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bUrP.exe PID: 7576, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Software Packing	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	21 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
bUrP.exe	76%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm
bUrP.exe	100%	Avira	HEUR/AGEN.1305769
bUrP.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
dzn.ddns.net	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dzn.ddns.net	191.233.27.50	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dzn.ddns.net	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
191.233.27.50	dzn.ddns.net	Brazil		8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1415997
Start date and time:	2024-03-26 18:08:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	bUrP.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@4/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 95% Number of executed functions: 18 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target bUrP.exe, PID 7576 because it is empty
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: bUrP.exe

Simulations

Behavior and APIs

Time	Type	Description
15:09:02	API Interceptor	14618199x Sleep call for process: bUrP.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
191.233.27.50	m6ynVs5wGI.exe	Get hash	malicious	Njrat	Browse
191.233.27.50	bTcO.exe	Get hash	malicious	XWorm	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dzn.ddns.net	m6ynVs5wGI.exe	Get hash	malicious	Njrat	Browse	191.233.27.50
dzn.ddns.net	bTcO.exe	Get hash	malicious	XWorm	Browse	191.233.27.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://url.us.m.mimecastprotect.com/s/kyINCpYnk3FnPVPtPeQKH?domain=gcv.microsoft.us	Get hash	malicious	HTMLPhisher	Browse	52.127.240.65
	re-march-26-2024-6488.xlsx	Get hash	malicious	MAC Stealer	Browse	13.107.213.40
	https://38374993729929473939lk-us.de/202444/fresh2024link/schwab.com-fresh-RD588-user-ph-em(detail)/index.html	Get hash	malicious	Unknown	Browse	13.107.42.14
	https://new.express.adobe.com/webpage/sAiKE1YBfM7xe	Get hash	malicious	HTMLPhisher	Browse	52.96.88.2
	https://escwatersealuae-my.sharepoint.com/:b:/g/personal/coordinatorauh_watersealuae_com/EUgMEq3xHjpEtricc4GzY_gBScerXYXlOg6GhA2k7ick4g?e=1LFXqh	Get hash	malicious	Unknown	Browse	13.107.136.10
	https://usg02.safelinks.protection.office365.us/?url=https%3A%2F%2Frossdalecleprograms.bmailroute.net%2Fx%2Fd%3Fc%3D39280181%26l%3D2f3213c2-4b78-4245-ab7bec24c74da0c0%26r%3D6593b189-4eca-4deb-8017-9f09300903c0&data=05%7C02%7CMark.Shepherd%40dor.sc.gov%7C4d280c12a17e423dc1b008dc4da56570%7C304cb6fa07ed486cb7cb51ca42640e73%7C0%7C0%7C638470619979088564%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=iMmAqOqmUMgTXGPrjGJOgVW0iSy5fYzL5znUj%2FmTu2o%3D&reserved=0	Get hash	malicious	HTMLPhisher	Browse	23.103.209.28
	Quarantined Messages.zip	Get hash	malicious	HTMLPhisher	Browse	52.109.6.63
	https://1drv.ms/o/s!BFRjM-vQxGYFhElDOX-pd0RkvatP?e=Rp2e0wqCfEOklCep72qfVw&at=9&d=DwMFAw	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.42.12
	sample.doc	Get hash	malicious	Unknown	Browse	104.46.162.227
	https://app4aid.com	Get hash	malicious	HtmlDropper	Browse	13.107.246.40

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.594082671287542
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	bUrP.exe
File size:	30'720 bytes
MD5:	8cc1d92a748e389e44e4d2757e0c276f
SHA1:	314bf49942c9576ec1e6237985a770a891c91380
SHA256:	1e5a837d5e69be8d6e3eb8143e4d96204b5116b5426df20acd769506ab4b3d6f
SHA512:	2ed1c85585eac3b60daa2ed0542dac8215779cdd2f63ff6f19a1b35be0337b3620acc2ce7476d4a6c890ea228c69b2d849fb197dd7d7c7aa70329516a7a3cdb3
SSDEEP:	768:Pecbl/b37gMYAoRFNU2uBFE9RROqhobr:Wcx6NU24FE9RROqOf
TLSH:	9DD24C483BE84327D6FE2FF229B2910102759507D923EF5F5CD885ABAF67B8146013E6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....].e.................n............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x408dee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65DD5D19 [Tue Feb 27 03:55:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8d9c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x4d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6df4	0x6e00	e39b52c093b517307be99d2a61f31366	False	0.5041193181818182	data	5.759196372207289	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x4d8	0x600	afbb984503128042cc38bf70e5e337f4	False	0.375	data	3.7203482473352403	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	026603c255b46d30f672aaf50e95a5c1	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xa0a0	0x244	data			0.4724137931034483
RT_MANIFEST	0xa2e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2024 18:09:01.101902962 CET	49729	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:01.320398092 CET	5552	49729	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:01.822320938 CET	49729	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:02.041184902 CET	5552	49729	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:02.556736946 CET	49729	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:02.776515007 CET	5552	49729	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:03.291141987 CET	49729	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:03.510658026 CET	5552	49729	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:04.025466919 CET	49729	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:04.244297028 CET	5552	49729	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:04.371257067 CET	49730	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:04.592288971 CET	5552	49730	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:05.103583097 CET	49730	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:05.323235989 CET	5552	49730	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:05.837939978 CET	49730	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:06.058032036 CET	5552	49730	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:06.572362900 CET	49730	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:06.791831017 CET	5552	49730	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:07.306749105 CET	49730	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:07.526420116 CET	5552	49730	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:12.292799950 CET	49734	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:12.512335062 CET	5552	49734	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:13.025433064 CET	49734	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:13.244421959 CET	5552	49734	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:13.759835005 CET	49734	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:13.981095076 CET	5552	49734	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:14.494210958 CET	49734	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:14.713227034 CET	5552	49734	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:15.228651047 CET	49734	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:15.447365046 CET	5552	49734	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:15.558700085 CET	49738	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:15.778608084 CET	5552	49738	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:16.291189909 CET	49738	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:16.511068106 CET	5552	49738	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:17.025531054 CET	49738	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:17.245429039 CET	5552	49738	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:17.759834051 CET	49738	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:17.979770899 CET	5552	49738	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:18.494244099 CET	49738	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:18.714088917 CET	5552	49738	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:18.823781967 CET	49739	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:19.042258024 CET	5552	49739	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:19.556811094 CET	49739	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:19.777168989 CET	5552	49739	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:20.291250944 CET	49739	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:20.510409117 CET	5552	49739	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:21.025554895 CET	49739	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:21.243920088 CET	5552	49739	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:21.744193077 CET	49739	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:21.964894056 CET	5552	49739	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:22.073951006 CET	49740	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:22.293457031 CET	5552	49740	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:22.806720018 CET	49740	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:23.026546955 CET	5552	49740	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:23.541079044 CET	49740	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:23.760929108 CET	5552	49740	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:24.275492907 CET	49740	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:24.495218992 CET	5552	49740	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:25.009851933 CET	49740	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:25.229496956 CET	5552	49740	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:25.339770079 CET	49741	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:25.559264898 CET	5552	49741	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:26.072344065 CET	49741	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:26.293791056 CET	5552	49741	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:26.806684971 CET	49741	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:27.026213884 CET	5552	49741	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:27.541177988 CET	49741	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:27.760757923 CET	5552	49741	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:28.291129112 CET	49741	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:28.510536909 CET	5552	49741	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:28.653320074 CET	49742	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:28.872128963 CET	5552	49742	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:29.384799957 CET	49742	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:29.609244108 CET	5552	49742	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:30.119339943 CET	49742	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:30.337908030 CET	5552	49742	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:30.838012934 CET	49742	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:31.056710005 CET	5552	49742	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:31.556794882 CET	49742	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:31.775580883 CET	5552	49742	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:31.886292934 CET	49743	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:32.105530024 CET	5552	49743	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:32.619292021 CET	49743	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:32.837567091 CET	5552	49743	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:33.337923050 CET	49743	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:33.556174040 CET	5552	49743	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:34.072483063 CET	49743	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:34.291096926 CET	5552	49743	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:34.806755066 CET	49743	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:35.025259018 CET	5552	49743	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:35.136106968 CET	49744	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:35.355108023 CET	5552	49744	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:35.869190931 CET	49744	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:36.088895082 CET	5552	49744	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:36.603626013 CET	49744	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:36.822774887 CET	5552	49744	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:37.338030100 CET	49744	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:37.557504892 CET	5552	49744	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:38.072520018 CET	49744	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:38.291678905 CET	5552	49744	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:38.403753042 CET	49745	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:38.623858929 CET	5552	49745	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:39.134820938 CET	49745	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:39.354607105 CET	5552	49745	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:39.869302988 CET	49745	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:40.089165926 CET	5552	49745	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:40.603672981 CET	49745	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:40.823544025 CET	5552	49745	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:41.338140011 CET	49745	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:41.557755947 CET	5552	49745	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:41.667375088 CET	49746	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:41.886140108 CET	5552	49746	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:42.400521994 CET	49746	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:42.619257927 CET	5552	49746	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:43.134783983 CET	49746	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:43.355439901 CET	5552	49746	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:43.869364977 CET	49746	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:44.088638067 CET	5552	49746	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:44.603566885 CET	49746	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:44.822062016 CET	5552	49746	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:45.104769945 CET	49747	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:45.325185061 CET	5552	49747	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:45.838006020 CET	49747	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:46.058892012 CET	5552	49747	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:46.572300911 CET	49747	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:46.793095112 CET	5552	49747	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:47.306669950 CET	49747	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:47.527290106 CET	5552	49747	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:48.041059017 CET	49747	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:48.261785030 CET	5552	49747	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:48.370248079 CET	49748	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:48.589576960 CET	5552	49748	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:49.103596926 CET	49748	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:49.322859049 CET	5552	49748	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:49.838027954 CET	49748	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:50.058042049 CET	5552	49748	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:50.572329998 CET	49748	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:50.792180061 CET	5552	49748	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:51.306680918 CET	49748	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:51.526130915 CET	5552	49748	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:51.636296988 CET	49750	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:51.855850935 CET	5552	49750	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:52.369204044 CET	49750	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:52.588785887 CET	5552	49750	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:53.103542089 CET	49750	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:53.323287964 CET	5552	49750	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:53.837917089 CET	49750	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:54.057657003 CET	5552	49750	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:54.572329044 CET	49750	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:54.792074919 CET	5552	49750	191.233.27.50	192.168.2.4
Mar 26, 2024 18:09:59.558325052 CET	49751	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:09:59.777532101 CET	5552	49751	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:00.291224957 CET	49751	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:00.510529995 CET	5552	49751	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:01.025393963 CET	49751	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:01.244479895 CET	5552	49751	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:01.759794950 CET	49751	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:01.978837013 CET	5552	49751	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:02.494139910 CET	49751	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:02.713267088 CET	5552	49751	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:07.707500935 CET	49752	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:07.926103115 CET	5552	49752	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:08.431641102 CET	49752	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:08.650285959 CET	5552	49752	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:09.150396109 CET	49752	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:09.369472027 CET	5552	49752	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:09.884773970 CET	49752	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:10.103745937 CET	5552	49752	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:10.619152069 CET	49752	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:10.837901115 CET	5552	49752	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:10.949238062 CET	49753	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:11.169398069 CET	5552	49753	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:11.682909012 CET	49753	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:11.902642012 CET	5552	49753	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:12.416018963 CET	49753	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:12.637120008 CET	5552	49753	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:13.150566101 CET	49753	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:13.370549917 CET	5552	49753	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:13.884932995 CET	49753	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:14.104585886 CET	5552	49753	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:14.216944933 CET	49754	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:14.435832977 CET	5552	49754	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:14.947267056 CET	49754	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:15.168715954 CET	5552	49754	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:15.682918072 CET	49754	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:15.901765108 CET	5552	49754	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:16.416042089 CET	49754	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:16.635719061 CET	5552	49754	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:17.150404930 CET	49754	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:17.369636059 CET	5552	49754	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:17.481345892 CET	49755	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:17.701256037 CET	5552	49755	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:18.212915897 CET	49755	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:18.432857037 CET	5552	49755	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:18.978518009 CET	49755	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:19.198820114 CET	5552	49755	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:19.869220018 CET	49755	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:20.089232922 CET	5552	49755	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:20.681651115 CET	49755	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:20.901901007 CET	5552	49755	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:21.066612005 CET	49756	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:21.286537886 CET	5552	49756	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:21.791115999 CET	49756	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:22.011394024 CET	5552	49756	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:22.603545904 CET	49756	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:22.823302031 CET	5552	49756	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:23.400958061 CET	49756	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:23.622412920 CET	5552	49756	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:24.293699026 CET	49756	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:24.515208006 CET	5552	49756	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:29.421123981 CET	49757	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:29.642024994 CET	5552	49757	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:30.181696892 CET	49757	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:30.401957035 CET	5552	49757	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:31.013963938 CET	49757	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:31.234184027 CET	5552	49757	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:31.869157076 CET	49757	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:32.089230061 CET	5552	49757	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:32.681634903 CET	49757	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:32.901856899 CET	5552	49757	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:37.011789083 CET	49758	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:37.231172085 CET	5552	49758	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:37.869249105 CET	49758	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:38.088525057 CET	5552	49758	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:38.681639910 CET	49758	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:38.901276112 CET	5552	49758	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:39.481251001 CET	49758	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:39.700578928 CET	5552	49758	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:40.369142056 CET	49758	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:40.588563919 CET	5552	49758	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:40.700691938 CET	49759	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:40.919013977 CET	5552	49759	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:41.589066029 CET	49759	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:41.807414055 CET	5552	49759	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:42.400374889 CET	49759	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:42.618887901 CET	5552	49759	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:43.197267056 CET	49759	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:43.415627956 CET	5552	49759	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:44.088874102 CET	49759	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:44.307265043 CET	5552	49759	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:44.418982029 CET	49760	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:44.638159990 CET	5552	49760	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:45.197253942 CET	49760	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:45.416891098 CET	5552	49760	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:45.934880018 CET	49760	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:46.154329062 CET	5552	49760	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:46.666003942 CET	49760	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:46.885471106 CET	5552	49760	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:47.400381088 CET	49760	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:47.620138884 CET	5552	49760	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:47.730874062 CET	49761	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:47.954552889 CET	5552	49761	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:48.463278055 CET	49761	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:48.683850050 CET	5552	49761	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:49.341864109 CET	49761	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:49.562743902 CET	5552	49761	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:50.182873011 CET	49761	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:50.403580904 CET	5552	49761	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:50.931886911 CET	49761	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:51.152467012 CET	5552	49761	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:51.261717081 CET	49762	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:51.480923891 CET	5552	49762	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:52.090948105 CET	49762	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:52.309988022 CET	5552	49762	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:52.932832003 CET	49762	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:53.152337074 CET	5552	49762	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:53.778866053 CET	49762	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:53.998127937 CET	5552	49762	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:54.580745935 CET	49762	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:54.799839020 CET	5552	49762	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:54.905232906 CET	49763	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:55.124190092 CET	5552	49763	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:55.634767056 CET	49763	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:55.854310989 CET	5552	49763	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:56.370968103 CET	49763	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:56.589941978 CET	5552	49763	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:57.291006088 CET	49763	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:57.510098934 CET	5552	49763	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:58.166001081 CET	49763	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:58.385296106 CET	5552	49763	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:58.501384020 CET	49764	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:58.720890999 CET	5552	49764	191.233.27.50	192.168.2.4
Mar 26, 2024 18:10:59.384749889 CET	49764	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:10:59.604211092 CET	5552	49764	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:00.145049095 CET	49764	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:00.364175081 CET	5552	49764	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:00.869129896 CET	49764	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:01.088828087 CET	5552	49764	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:01.590611935 CET	49764	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:01.810199022 CET	5552	49764	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:05.266889095 CET	49765	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:05.491573095 CET	5552	49765	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:05.994127989 CET	49765	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:06.213393927 CET	5552	49765	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:06.728544950 CET	49765	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:06.948051929 CET	5552	49765	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:07.462868929 CET	49765	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:07.682269096 CET	5552	49765	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:08.197232962 CET	49765	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:08.416731119 CET	5552	49765	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:08.630868912 CET	49766	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:08.850327969 CET	5552	49766	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:09.354851007 CET	49766	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:09.574501038 CET	5552	49766	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:10.098383904 CET	49766	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:10.317806005 CET	5552	49766	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:10.822343111 CET	49766	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:11.041742086 CET	5552	49766	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:11.556607962 CET	49766	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:11.776400089 CET	5552	49766	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:15.596540928 CET	49767	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:15.814891100 CET	5552	49767	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:16.380819082 CET	49767	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:16.599181890 CET	5552	49767	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:17.212963104 CET	49767	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:17.434714079 CET	5552	49767	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:17.950649023 CET	49767	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:18.169775963 CET	5552	49767	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:18.697231054 CET	49767	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:18.915668011 CET	5552	49767	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:19.011188030 CET	49768	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:19.231265068 CET	5552	49768	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:19.744118929 CET	49768	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:19.963092089 CET	5552	49768	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:20.480937004 CET	49768	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:20.700285912 CET	5552	49768	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:21.213748932 CET	49768	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:21.432621956 CET	5552	49768	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:21.947237968 CET	49768	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:22.166445971 CET	5552	49768	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:26.293474913 CET	49769	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:26.513643980 CET	5552	49769	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:27.216850996 CET	49769	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:27.436870098 CET	5552	49769	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:28.009752035 CET	49769	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:28.232522011 CET	5552	49769	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:28.809462070 CET	49769	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:29.029620886 CET	5552	49769	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:29.620385885 CET	49769	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:29.841167927 CET	5552	49769	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:29.933883905 CET	49770	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:30.152820110 CET	5552	49770	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:30.669322014 CET	49770	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:30.888155937 CET	5552	49770	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:31.400995016 CET	49770	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:31.619739056 CET	5552	49770	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:32.212862015 CET	49770	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:32.431662083 CET	5552	49770	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:33.009807110 CET	49770	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:33.228863001 CET	5552	49770	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:37.277318954 CET	49771	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:37.496731997 CET	5552	49771	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:38.009716988 CET	49771	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:38.233405113 CET	5552	49771	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:38.745811939 CET	49771	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:38.965147018 CET	5552	49771	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:39.481486082 CET	49771	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:39.700645924 CET	5552	49771	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:40.212847948 CET	49771	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:40.432461977 CET	5552	49771	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:40.512366056 CET	49772	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:40.731183052 CET	5552	49772	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:41.401896954 CET	49772	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:41.621007919 CET	5552	49772	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:42.243338108 CET	49772	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:42.462451935 CET	5552	49772	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:43.012948990 CET	49772	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:43.232136011 CET	5552	49772	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:43.782217026 CET	49772	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:44.001298904 CET	5552	49772	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:44.074074030 CET	49773	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:44.291625023 CET	5552	49773	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:44.806900024 CET	49773	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:45.024691105 CET	5552	49773	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:45.525369883 CET	49773	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:45.742994070 CET	5552	49773	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:46.244087934 CET	49773	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:46.461921930 CET	5552	49773	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:46.962862968 CET	49773	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:47.180506945 CET	5552	49773	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:49.731906891 CET	49774	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:49.953681946 CET	5552	49774	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:50.478468895 CET	49774	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:50.698621035 CET	5552	49774	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:51.230813980 CET	49774	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:51.450841904 CET	5552	49774	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:51.978576899 CET	49774	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:52.198637962 CET	5552	49774	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:52.744106054 CET	49774	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:52.964072943 CET	5552	49774	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:53.028697014 CET	49775	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:53.248629093 CET	5552	49775	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:53.806588888 CET	49775	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:54.028309107 CET	5552	49775	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:54.641902924 CET	49775	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:54.861349106 CET	5552	49775	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:55.437689066 CET	49775	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:55.657505035 CET	5552	49775	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:56.197379112 CET	49775	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:56.417162895 CET	5552	49775	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:56.480829000 CET	49776	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:56.699738026 CET	5552	49776	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:57.239119053 CET	49776	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:57.458525896 CET	5552	49776	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:58.009723902 CET	49776	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:58.228836060 CET	5552	49776	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:58.737344027 CET	49776	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:58.956588030 CET	5552	49776	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:59.545212984 CET	49776	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:11:59.769471884 CET	5552	49776	191.233.27.50	192.168.2.4
Mar 26, 2024 18:11:59.842797995 CET	49777	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:00.061777115 CET	5552	49777	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:00.744079113 CET	49777	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:00.962933064 CET	5552	49777	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:01.540963888 CET	49777	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:01.759639025 CET	5552	49777	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:02.431613922 CET	49777	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:02.650391102 CET	5552	49777	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:03.244080067 CET	49777	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:03.462568998 CET	5552	49777	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:03.527895927 CET	49778	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:03.746861935 CET	5552	49778	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:04.337852001 CET	49778	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:04.557426929 CET	5552	49778	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:05.228468895 CET	49778	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:05.447571993 CET	5552	49778	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:06.040957928 CET	49778	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:06.260471106 CET	5552	49778	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:06.837847948 CET	49778	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:07.057024956 CET	5552	49778	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:07.121375084 CET	49779	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:07.340044975 CET	5552	49779	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:08.009788990 CET	49779	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:08.228343010 CET	5552	49779	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:08.802654982 CET	49779	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:09.022025108 CET	5552	49779	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:09.603511095 CET	49779	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:09.822346926 CET	5552	49779	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:10.400373936 CET	49779	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:10.619280100 CET	5552	49779	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:13.313118935 CET	49780	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:13.531744957 CET	5552	49780	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:14.134710073 CET	49780	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:14.353442907 CET	5552	49780	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:14.931576967 CET	49780	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:15.150542021 CET	5552	49780	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:15.822262049 CET	49780	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:16.040751934 CET	5552	49780	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:16.634706020 CET	49780	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:16.853343964 CET	5552	49780	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:16.918567896 CET	49781	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:17.137270927 CET	5552	49781	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:17.650782108 CET	49781	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:17.869066000 CET	5552	49781	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:18.386785030 CET	49781	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:18.604979038 CET	5552	49781	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:19.119090080 CET	49781	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:19.337390900 CET	5552	49781	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:19.837835073 CET	49781	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:20.056720018 CET	5552	49781	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:20.121872902 CET	49782	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:20.340624094 CET	5552	49782	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:20.853446960 CET	49782	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:21.072333097 CET	5552	49782	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:21.572196960 CET	49782	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:21.791115999 CET	5552	49782	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:22.310769081 CET	49782	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:22.529403925 CET	5552	49782	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:23.040952921 CET	49782	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:23.259746075 CET	5552	49782	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:25.340228081 CET	49783	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:25.560631037 CET	5552	49783	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:26.073088884 CET	49783	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:26.293137074 CET	5552	49783	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:26.806591988 CET	49783	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:27.029489994 CET	5552	49783	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:27.540941954 CET	49783	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:27.768274069 CET	5552	49783	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:28.278768063 CET	49783	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:28.499200106 CET	5552	49783	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:28.562772989 CET	49784	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:28.781596899 CET	5552	49784	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:29.287061930 CET	49784	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:29.506246090 CET	5552	49784	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:30.009706020 CET	49784	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:30.228449106 CET	5552	49784	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:30.744091034 CET	49784	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:30.963126898 CET	5552	49784	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:31.478456974 CET	49784	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:31.697726965 CET	5552	49784	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:31.746148109 CET	49785	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:31.964449883 CET	5552	49785	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:32.481375933 CET	49785	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:32.699629068 CET	5552	49785	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:33.212821960 CET	49785	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:33.431365013 CET	5552	49785	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:33.948951960 CET	49785	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:34.167144060 CET	5552	49785	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:34.681566000 CET	49785	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:34.900518894 CET	5552	49785	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:34.948966980 CET	49786	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:35.168905973 CET	5552	49786	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:35.681582928 CET	49786	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:35.901917934 CET	5552	49786	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:36.415945053 CET	49786	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:36.636353016 CET	5552	49786	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:37.150312901 CET	49786	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:37.371228933 CET	5552	49786	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:37.884824991 CET	49786	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:38.104891062 CET	5552	49786	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:39.793180943 CET	49787	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:40.012317896 CET	5552	49787	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:40.526752949 CET	49787	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:40.745287895 CET	5552	49787	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:41.257265091 CET	49787	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:41.475848913 CET	5552	49787	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:41.978755951 CET	49787	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:42.197508097 CET	5552	49787	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:42.712824106 CET	49787	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:42.931492090 CET	5552	49787	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:45.138762951 CET	49788	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:45.357358932 CET	5552	49788	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:45.869066000 CET	49788	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:46.087682962 CET	5552	49788	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:46.686753988 CET	49788	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:46.905905008 CET	5552	49788	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:47.478538036 CET	49788	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:47.699464083 CET	5552	49788	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:48.275312901 CET	49788	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:48.494000912 CET	5552	49788	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:48.527096033 CET	49789	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:48.746474981 CET	5552	49789	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:49.324976921 CET	49789	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:49.544322968 CET	5552	49789	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:50.113482952 CET	49789	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:50.332906008 CET	5552	49789	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:50.838747025 CET	49789	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:51.058235884 CET	5552	49789	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:51.634722948 CET	49789	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:51.854055882 CET	5552	49789	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:51.902276039 CET	49790	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:52.120868921 CET	5552	49790	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:52.627435923 CET	49790	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:52.846256971 CET	5552	49790	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:53.354743958 CET	49790	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:53.573729038 CET	5552	49790	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:54.076865911 CET	49790	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:54.298032999 CET	5552	49790	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:54.806746960 CET	49790	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:55.025701046 CET	5552	49790	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:55.074754000 CET	49791	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:55.294683933 CET	5552	49791	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:55.806705952 CET	49791	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:56.027324915 CET	5552	49791	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:56.540951014 CET	49791	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:56.760869026 CET	5552	49791	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:57.278744936 CET	49791	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:57.498646975 CET	5552	49791	191.233.27.50	192.168.2.4
Mar 26, 2024 18:12:58.009717941 CET	49791	5552	192.168.2.4	191.233.27.50
Mar 26, 2024 18:12:58.230659962 CET	5552	49791	191.233.27.50	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 26, 2024 18:09:00.996186972 CET	51881	53	192.168.2.4	1.1.1.1
Mar 26, 2024 18:09:01.094980001 CET	53	51881	1.1.1.1	192.168.2.4
Mar 26, 2024 18:10:07.605846882 CET	65102	53	192.168.2.4	1.1.1.1
Mar 26, 2024 18:10:07.704265118 CET	53	65102	1.1.1.1	192.168.2.4
Mar 26, 2024 18:11:08.527663946 CET	55668	53	192.168.2.4	1.1.1.1
Mar 26, 2024 18:11:08.624799013 CET	53	55668	1.1.1.1	192.168.2.4
Mar 26, 2024 18:12:13.215584040 CET	56031	53	192.168.2.4	1.1.1.1
Mar 26, 2024 18:12:13.312345982 CET	53	56031	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 26, 2024 18:09:00.996186972 CET	192.168.2.4	1.1.1.1	0xdbe1	Standard query (0)	dzn.ddns.net	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:10:07.605846882 CET	192.168.2.4	1.1.1.1	0x5b08	Standard query (0)	dzn.ddns.net	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:11:08.527663946 CET	192.168.2.4	1.1.1.1	0xd1b0	Standard query (0)	dzn.ddns.net	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:12:13.215584040 CET	192.168.2.4	1.1.1.1	0xa6c9	Standard query (0)	dzn.ddns.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 26, 2024 18:09:01.094980001 CET	1.1.1.1	192.168.2.4	0xdbe1	No error (0)	dzn.ddns.net	191.233.27.50	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:10:07.704265118 CET	1.1.1.1	192.168.2.4	0x5b08	No error (0)	dzn.ddns.net	191.233.27.50	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:11:08.624799013 CET	1.1.1.1	192.168.2.4	0xd1b0	No error (0)	dzn.ddns.net	191.233.27.50	A (IP address)	IN (0x0001)	false
Mar 26, 2024 18:12:13.312345982 CET	1.1.1.1	192.168.2.4	0xa6c9	No error (0)	dzn.ddns.net	191.233.27.50	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	15:08:51
Start date:	26/03/2024
Path:	C:\Users\user\Desktop\bUrP.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\bUrP.exe"
Imagebase:	0x580000
File size:	30'720 bytes
MD5 hash:	8CC1D92A748E389E44E4D2757E0C276F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1618143277.0000000000582000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00007FFD9B881884 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99591b797581748355f50fb51bb72057e8d33ca5ab1fd3e6c2415f8663c31404
Instruction ID: 41a3200fa045b17016bd3c44bd559f937d9126aff8710d6de425b824b9c02acd
Opcode Fuzzy Hash: 99591b797581748355f50fb51bb72057e8d33ca5ab1fd3e6c2415f8663c31404
Instruction Fuzzy Hash: 66919820F1DE8A4FE759A73848756A87BD1EF9D340F5401BAD09AC32E7EE7C68028351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880700 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79385bbf6f9ade6de386981d7d99fd7b8bc7ef074199c0874dff4744754e1fa
Instruction ID: ec29270731077d1a8ecce6b904a6e21706739a6062864b01296998ced276b358
Opcode Fuzzy Hash: f79385bbf6f9ade6de386981d7d99fd7b8bc7ef074199c0874dff4744754e1fa
Instruction Fuzzy Hash: 7E713661F19D4D4FEBA8EB2894696B977D2EF9C340F54007DE01ED32D6EE7869028381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880915 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed8dd08e667b183a0dd77729373587a87eb0a9ce9493d7e19a7bdaab4ebbeaa
Instruction ID: fdcb1a96b91c26e5c43e8b3d212c91aeaf3aae92d8be023d68623bc6ec2f8cf0
Opcode Fuzzy Hash: 5ed8dd08e667b183a0dd77729373587a87eb0a9ce9493d7e19a7bdaab4ebbeaa
Instruction Fuzzy Hash: 46511621B2AD4E4FD798A77858796BC7BA1EF98204B8005BDE06EC31D7EE3C69058351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880F3E Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30b6dcff0bc68a287f6303cb198392d6c95b7e26ab7cc2ce7113f2ca798f90a9
Instruction ID: c8a71535399cc0fc03903512cca08dc52b8aa82ee3195bdf9ed95c8a0b50151f
Opcode Fuzzy Hash: 30b6dcff0bc68a287f6303cb198392d6c95b7e26ab7cc2ce7113f2ca798f90a9
Instruction Fuzzy Hash: 86516D21B1EA890FE396B73858669793BD1DF8A214B0940FAD49DC71E7DD1C9C428352

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880708 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1b64884f392c2b6de951dcb174f5e6ae51690bacc22b7a4ce4c65aa8466f0a
Instruction ID: 9eeec9679671319304b724afe4a72742968ffe1c82ee7ea209da76537446f99b
Opcode Fuzzy Hash: 6c1b64884f392c2b6de951dcb174f5e6ae51690bacc22b7a4ce4c65aa8466f0a
Instruction Fuzzy Hash: 0051B070A0891DCFEB69FB68E469AF977E0EF58315F04017ED04EC3292DB74A8428B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880B2A Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322aa0a5edf3b6be406cc2276ea7b97a8ce23def479bfc4adc8d6127dd33ba4a
Instruction ID: fda963e6d36fbb4154a2e3eeda0df992b9b874e09af42deb866fece21b41658c
Opcode Fuzzy Hash: 322aa0a5edf3b6be406cc2276ea7b97a8ce23def479bfc4adc8d6127dd33ba4a
Instruction Fuzzy Hash: FE412721B1DA890FE788AB7C98256787BD2EF89614B0901FFE05DC72E7DD289C028341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881640 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54fc2b86327e656ed4b34b5438fb8ad9a444582efdbb18358d248775b5e8b0a
Instruction ID: 05d41a8a1f38c381fcc85443aea7042af678e56d6cd038a0a74f22d3722f37b5
Opcode Fuzzy Hash: d54fc2b86327e656ed4b34b5438fb8ad9a444582efdbb18358d248775b5e8b0a
Instruction Fuzzy Hash: CA41A474A09A4DCFDB68EB68D455BA977F0FF59311F00016ED049C32A1DB75A841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880750 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c067bd3faf8496a8562b9796873380f321733c75097a5b48ea0f034eab00a4c
Instruction ID: 21cff5d7403ffbc395c1606c826c3e40c8c6dfc54be79807df9eb821b6240ebb
Opcode Fuzzy Hash: 9c067bd3faf8496a8562b9796873380f321733c75097a5b48ea0f034eab00a4c
Instruction Fuzzy Hash: D5417C74A09A1DCFEBA8EF68D459BB977E0FB58311F00016ED00AD32A1DB75A841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8804C8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5050658ce24c5f60a0ac12045c80bd7fb55a9e631a91e15bfecca3f5f76aa3
Instruction ID: d23cdcebf1ec47ade6e6dfa234693e6fff8ea0bc19752a1459f6f8f4f8f59388
Opcode Fuzzy Hash: 1e5050658ce24c5f60a0ac12045c80bd7fb55a9e631a91e15bfecca3f5f76aa3
Instruction Fuzzy Hash: 7E31F721B189484FE798EB6C9869A7976C2EFDC715F0505BEE05EC32E7DD24AC418341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880C91 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad8460a3716af2c4eb2fc3e68c1c3857e5b00a3ca617ca3b13fcf343e720b8b3
Instruction ID: 9a8bdbe36c20a285aca0e21e2f0577dc2b4c8a6eb35826e7fa593be7e7b338af
Opcode Fuzzy Hash: ad8460a3716af2c4eb2fc3e68c1c3857e5b00a3ca617ca3b13fcf343e720b8b3
Instruction Fuzzy Hash: 0041D374A19A4D8FDB58EBB898616BDBBB1FF88300F4004BAD019D32D7DE38A9458750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880DD9 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9949d611840d42321c68033e302f6378ad7236197aaae53e32db9285bdbccea7
Instruction ID: d79b4d430d1559565bdc0efda05211dc42ab551963bebce808dd9cd91573b31f
Opcode Fuzzy Hash: 9949d611840d42321c68033e302f6378ad7236197aaae53e32db9285bdbccea7
Instruction Fuzzy Hash: DD31B461B1990A4FEB99BBB858697BD76D1EF98700F0402B7E02DC32D6DE28AD414391

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88146D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4304715a4d463318763046584369cb71895be45d0ec466816fd2aa813f048482
Instruction ID: a76e11a088ff436cf0668f94497813b8b12888560abf7f50bb09139e9d7c59a9
Opcode Fuzzy Hash: 4304715a4d463318763046584369cb71895be45d0ec466816fd2aa813f048482
Instruction Fuzzy Hash: 74214C61A0E94A8FE724EBA4C8619B077D0EF9D354F0944B9C01DCB1E3EE3CA4428750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8813B5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e001d2352ec959c24c0b1afe07d0d6e49b1731fced98173356a6dce0ccaf8c
Instruction ID: ace289223d1782a3e2288f4b8b85376fa45179b7485384b4f56c8d4856a03013
Opcode Fuzzy Hash: f1e001d2352ec959c24c0b1afe07d0d6e49b1731fced98173356a6dce0ccaf8c
Instruction Fuzzy Hash: 3511F620F1EA4A8BF774B7B448365B83292AF99314F660079D02DC71E3DE3DA9028381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881281 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a243d18d23b23de0f2ccc85df06725dce12ebc938f74591f22b6da56dcfa8774
Instruction ID: dadccafe90cf36e88857141336c215c3019a19bf3609d17a4e66001956f6ad42
Opcode Fuzzy Hash: a243d18d23b23de0f2ccc85df06725dce12ebc938f74591f22b6da56dcfa8774
Instruction Fuzzy Hash: A1110AB1E08A8D8FD79DDB2894A92B97FE1EBE9300F8400AFD459D71D2EF7815058311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881339 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df9ef9ec50f85cf037f6f6f6eaf5334021811e1beefc7231caebc90920dad6bf
Instruction ID: 1e8fedf1a2bdb68ca98ba7894029706cce3152d095642ac681c208b26274bdf5
Opcode Fuzzy Hash: df9ef9ec50f85cf037f6f6f6eaf5334021811e1beefc7231caebc90920dad6bf
Instruction Fuzzy Hash: 9201F711F0EB898FF765777848352B42A91AF59700F1A00FAD059C75E7DD2D6C85C342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881418 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1140a0fc489f317be8c92053847bf6ff11cf08ff39fc382d48e5903b14cadfb3
Instruction ID: 5d269686e92617ae855e57912c2374ad776a4c427d298ee15af6f1c80b97905d
Opcode Fuzzy Hash: 1140a0fc489f317be8c92053847bf6ff11cf08ff39fc382d48e5903b14cadfb3
Instruction Fuzzy Hash: 32F08170E0D80A8BE375EB5884616B873A2EF9C310F614574C02DC71E5DF38B9428791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B881101 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9d6056080527162c64df3ce5d08f909bdc1a4620bc7c28024b733e6cb84f67
Instruction ID: a7e81d8095fb0bc074716db242155c099fb60a004a2eb86e6bb28a80b78391d4
Opcode Fuzzy Hash: 9e9d6056080527162c64df3ce5d08f909bdc1a4620bc7c28024b733e6cb84f67
Instruction Fuzzy Hash: A0E0CD3586E7CD4FE7A29F5488261D9BF60FF59200F4511CFE55887053DA2596184382

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B880540 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4068588495.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b880000_bUrP.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0e46dc64f8a2847caa49296849c7220a4199954dda86525dd6ff78812fcc25f
Instruction ID: cf6551d0e25fab144161bf60aa64b36dab938327fb4c14cf1950cc6903dc1d87
Opcode Fuzzy Hash: d0e46dc64f8a2847caa49296849c7220a4199954dda86525dd6ff78812fcc25f
Instruction Fuzzy Hash: 7DD05EA0E1F84A53F33577B14825ABA29A58FCD744F160074E02D964EA9E7C2A4443A1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bUrP.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Windows Analysis Report
bUrP.exe