Edit tour

Windows Analysis Report
tiodtk2cfy.exe

Overview

General Information

Sample name:	tiodtk2cfy.exe renamed because original name is a hash value
Original sample name:	b56be916b1ca250cd9fe04b283e0c3ee.exe
Analysis ID:	1368193
MD5:	b56be916b1ca250cd9fe04b283e0c3ee
SHA1:	8f10d4274fb142a1b296702d5a430e95d3225e9b
SHA256:	a1586d89fcbda8b94c59634a7d68ba4b6e884c68a92355c6487068d2212b6043
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

Connects to many ports of the same IP (likely port scanning)

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to spread to USB devices (.Net source)

Creates autorun.inf (USB autostart)

Disables zone checking for all users

Drops PE files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

tiodtk2cfy.exe (PID: 7508 cmdline: C:\Users\user\Desktop\tiodtk2cfy.exe MD5: B56BE916B1CA250CD9FE04B283E0C3EE)

server.exe (PID: 7592 cmdline: "C:\Users\user\AppData\Roaming\server.exe" MD5: B56BE916B1CA250CD9FE04B283E0C3EE)

netsh.exe (PID: 7644 cmdline: netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Microsoft Corporation.exe (PID: 8036 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe" MD5: B56BE916B1CA250CD9FE04B283E0C3EE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Campaign ID": "VicTim", "Version": "0.7d", "Install Name": "a1d56127836419435d08d7cc0808a629", "Install Dir": "system", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
tiodtk2cfy.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
tiodtk2cfy.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a3d:$a2: SEE_MASK_NOZONECHECKS 0x156df:$a3: Download ERROR 0x15c8f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c1c:$a5: netsh firewall delete allowedprogram "
tiodtk2cfy.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c8f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a8:$s1: winmgmts:\\.\root\SecurityCenter2 0x156fd:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156df:$s6: Download ERROR 0x1376a:$s8: Select * From AntiVirusProduct
tiodtk2cfy.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a3d:$reg: SEE_MASK_NOZONECHECKS 0x156c3:$msg: Execute ERROR 0x15717:$msg: Execute ERROR 0x15c8f:$ping: cmd.exe /c ping 0 -n 2 & del
tiodtk2cfy.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c1c:$s1: netsh firewall delete allowedprogram 0x13c6e:$s2: netsh firewall add allowedprogram 0x15c8f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156c3:$s4: Execute ERROR 0x15717:$s4: Execute ERROR 0x156df:$s5: Download ERROR

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a3d:$a2: SEE_MASK_NOZONECHECKS 0x156df:$a3: Download ERROR 0x15c8f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c1c:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c8f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a8:$s1: winmgmts:\\.\root\SecurityCenter2 0x156fd:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156df:$s6: Download ERROR 0x1376a:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a3d:$reg: SEE_MASK_NOZONECHECKS 0x156c3:$msg: Execute ERROR 0x15717:$msg: Execute ERROR 0x15c8f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c1c:$s1: netsh firewall delete allowedprogram 0x13c6e:$s2: netsh firewall add allowedprogram 0x15c8f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156c3:$s4: Execute ERROR 0x15717:$s4: Execute ERROR 0x156df:$s5: Download ERROR
C:\Umbrella.flv.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\winhost.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Umbrella.flv.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a3d:$a2: SEE_MASK_NOZONECHECKS 0x156df:$a3: Download ERROR 0x15c8f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c1c:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a3d:$a2: SEE_MASK_NOZONECHECKS 0x156df:$a3: Download ERROR 0x15c8f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c1c:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\server.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Umbrella.flv.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c8f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a8:$s1: winmgmts:\\.\root\SecurityCenter2 0x156fd:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156df:$s6: Download ERROR 0x1376a:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\server.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a3d:$a2: SEE_MASK_NOZONECHECKS 0x156df:$a3: Download ERROR 0x15c8f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c1c:$a5: netsh firewall delete allowedprogram "
C:\winhost.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a3d:$a2: SEE_MASK_NOZONECHECKS 0x156df:$a3: Download ERROR 0x15c8f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c1c:$a5: netsh firewall delete allowedprogram "
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c8f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a8:$s1: winmgmts:\\.\root\SecurityCenter2 0x156fd:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156df:$s6: Download ERROR 0x1376a:$s8: Select * From AntiVirusProduct
C:\Umbrella.flv.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a3d:$reg: SEE_MASK_NOZONECHECKS 0x156c3:$msg: Execute ERROR 0x15717:$msg: Execute ERROR 0x15c8f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Umbrella.flv.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c1c:$s1: netsh firewall delete allowedprogram 0x13c6e:$s2: netsh firewall add allowedprogram 0x15c8f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156c3:$s4: Execute ERROR 0x15717:$s4: Execute ERROR 0x156df:$s5: Download ERROR
C:\winhost.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c8f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a8:$s1: winmgmts:\\.\root\SecurityCenter2 0x156fd:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156df:$s6: Download ERROR 0x1376a:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a3d:$reg: SEE_MASK_NOZONECHECKS 0x156c3:$msg: Execute ERROR 0x15717:$msg: Execute ERROR 0x15c8f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c1c:$s1: netsh firewall delete allowedprogram 0x13c6e:$s2: netsh firewall add allowedprogram 0x15c8f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156c3:$s4: Execute ERROR 0x15717:$s4: Execute ERROR 0x156df:$s5: Download ERROR
C:\winhost.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a3d:$reg: SEE_MASK_NOZONECHECKS 0x156c3:$msg: Execute ERROR 0x15717:$msg: Execute ERROR 0x15c8f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\winhost.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c1c:$s1: netsh firewall delete allowedprogram 0x13c6e:$s2: netsh firewall add allowedprogram 0x15c8f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156c3:$s4: Execute ERROR 0x15717:$s4: Execute ERROR 0x156df:$s5: Download ERROR
C:\Users\user\AppData\Roaming\server.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c8f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a8:$s1: winmgmts:\\.\root\SecurityCenter2 0x156fd:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156df:$s6: Download ERROR 0x1376a:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Roaming\server.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a3d:$reg: SEE_MASK_NOZONECHECKS 0x156c3:$msg: Execute ERROR 0x15717:$msg: Execute ERROR 0x15c8f:$ping: cmd.exe /c ping 0 -n 2 & del
C:\Users\user\AppData\Roaming\server.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c1c:$s1: netsh firewall delete allowedprogram 0x13c6e:$s2: netsh firewall add allowedprogram 0x15c8f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156c3:$s4: Execute ERROR 0x15717:$s4: Execute ERROR 0x156df:$s5: Download ERROR
Click to see the 20 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115f2:$a1: get_Registry 0x15a5d:$a2: SEE_MASK_NOZONECHECKS 0x156ff:$a3: Download ERROR 0x15caf:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c3c:$a5: netsh firewall delete allowedprogram "
00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a5d:$reg: SEE_MASK_NOZONECHECKS 0x156e3:$msg: Execute ERROR 0x15737:$msg: Execute ERROR 0x15caf:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x113d2:$a1: get_Registry 0x1583d:$a2: SEE_MASK_NOZONECHECKS 0x154df:$a3: Download ERROR 0x15a8f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13a1c:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x1583d:$reg: SEE_MASK_NOZONECHECKS 0x154c3:$msg: Execute ERROR 0x15517:$msg: Execute ERROR 0x15a8f:$ping: cmd.exe /c ping 0 -n 2 & del
00000001.00000002.4063644018.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: tiodtk2cfy.exe PID: 7508	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: server.exe PID: 7592	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.tiodtk2cfy.exe.470000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.tiodtk2cfy.exe.470000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x115d2:$a1: get_Registry 0x15a3d:$a2: SEE_MASK_NOZONECHECKS 0x156df:$a3: Download ERROR 0x15c8f:$a4: cmd.exe /c ping 0 -n 2 & del " 0x13c1c:$a5: netsh firewall delete allowedprogram "
0.0.tiodtk2cfy.exe.470000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x15c8f:$x1: cmd.exe /c ping 0 -n 2 & del " 0x137a8:$s1: winmgmts:\\.\root\SecurityCenter2 0x156fd:$s3: Executed As 0x124f0:$s5: Stub.exe 0x156df:$s6: Download ERROR 0x1376a:$s8: Select * From AntiVirusProduct
0.0.tiodtk2cfy.exe.470000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x15a3d:$reg: SEE_MASK_NOZONECHECKS 0x156c3:$msg: Execute ERROR 0x15717:$msg: Execute ERROR 0x15c8f:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.tiodtk2cfy.exe.470000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x13c1c:$s1: netsh firewall delete allowedprogram 0x13c6e:$s2: netsh firewall add allowedprogram 0x15c8f:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0x156c3:$s4: Execute ERROR 0x15717:$s4: Execute ERROR 0x156df:$s5: Download ERROR

Snort Signatures

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550070193542814856 12/30/23-07:00:48.954923
SID:	2814856
Source Port:	50070
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550072193542814856 12/30/23-07:00:49.937293
SID:	2814856
Source Port:	50072
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550071193542814856 12/30/23-07:00:49.443578
SID:	2814856
Source Port:	50071
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550074193542814856 12/30/23-07:00:50.928621
SID:	2814856
Source Port:	50074
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949844193542814856 12/30/23-06:58:53.964218
SID:	2814856
Source Port:	49844
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949845193542814856 12/30/23-06:58:54.461893
SID:	2814856
Source Port:	49845
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550073193542814856 12/30/23-07:00:50.430940
SID:	2814856
Source Port:	50073
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949846193542814856 12/30/23-06:58:54.962969
SID:	2814856
Source Port:	49846
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550078193542814856 12/30/23-07:00:52.921914
SID:	2814856
Source Port:	50078
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949847193542814856 12/30/23-06:58:55.462477
SID:	2814856
Source Port:	49847
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550075193542814856 12/30/23-07:00:51.423156
SID:	2814856
Source Port:	50075
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550079193542814856 12/30/23-07:00:53.417118
SID:	2814856
Source Port:	50079
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550076193542814856 12/30/23-07:00:51.914234
SID:	2814856
Source Port:	50076
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550077193542814856 12/30/23-07:00:52.429766
SID:	2814856
Source Port:	50077
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949843193542814856 12/30/23-06:58:53.458642
SID:	2814856
Source Port:	49843
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949832193542814856 12/30/23-06:58:47.148856
SID:	2814856
Source Port:	49832
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949831193542814856 12/30/23-06:58:46.651530
SID:	2814856
Source Port:	49831
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949840193542814856 12/30/23-06:58:51.198140
SID:	2814856
Source Port:	49840
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949830193542814856 12/30/23-06:58:46.139598
SID:	2814856
Source Port:	49830
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550080193542814856 12/30/23-07:00:53.911195
SID:	2814856
Source Port:	50080
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949763193542033132 12/30/23-06:57:58.658795
SID:	2033132
Source Port:	49763
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550060193542814856 12/30/23-07:00:44.073546
SID:	2814856
Source Port:	50060
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550061193542814856 12/30/23-07:00:44.563845
SID:	2814856
Source Port:	50061
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550081193542814856 12/30/23-07:00:54.395316
SID:	2814856
Source Port:	50081
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949762193542033132 12/30/23-06:57:56.539963
SID:	2033132
Source Port:	49762
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550082193542814856 12/30/23-07:00:58.229074
SID:	2814856
Source Port:	50082
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550064193542814856 12/30/23-07:00:46.036167
SID:	2814856
Source Port:	50064
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550063193542814856 12/30/23-07:00:45.540599
SID:	2814856
Source Port:	50063
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550062193542814856 12/30/23-07:00:45.053977
SID:	2814856
Source Port:	50062
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550068193542814856 12/30/23-07:00:47.982577
SID:	2814856
Source Port:	50068
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550067193542814856 12/30/23-07:00:47.495787
SID:	2814856
Source Port:	50067
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550069193542814856 12/30/23-07:00:48.469821
SID:	2814856
Source Port:	50069
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550065193542814856 12/30/23-07:00:46.523306
SID:	2814856
Source Port:	50065
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550066193542814856 12/30/23-07:00:47.015523
SID:	2814856
Source Port:	50066
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949773193542033132 12/30/23-06:58:10.061344
SID:	2033132
Source Port:	49773
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749910193542033132 12/30/23-06:59:28.395113
SID:	2033132
Source Port:	49910
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949777193542033132 12/30/23-06:58:13.628186
SID:	2033132
Source Port:	49777
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949822193542814856 12/30/23-06:58:42.080105
SID:	2814856
Source Port:	49822
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949771193542033132 12/30/23-06:58:08.096308
SID:	2033132
Source Port:	49771
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949779193542033132 12/30/23-06:58:15.550531
SID:	2033132
Source Port:	49779
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749912193542033132 12/30/23-06:59:29.368484
SID:	2033132
Source Port:	49912
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749894193542814856 12/30/23-06:59:19.912088
SID:	2814856
Source Port:	49894
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949824193542814856 12/30/23-06:58:43.090902
SID:	2814856
Source Port:	49824
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949826193542814856 12/30/23-06:58:44.099384
SID:	2814856
Source Port:	49826
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550081193542033132 12/30/23-07:00:54.154302
SID:	2033132
Source Port:	50081
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949828193542814856 12/30/23-06:58:45.123472
SID:	2814856
Source Port:	49828
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749890193542814856 12/30/23-06:59:17.969044
SID:	2814856
Source Port:	49890
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749892193542814856 12/30/23-06:59:18.951027
SID:	2814856
Source Port:	49892
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949841193542033132 12/30/23-06:58:52.214516
SID:	2033132
Source Port:	49841
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749908193542033132 12/30/23-06:59:26.520668
SID:	2033132
Source Port:	49908
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749918193542033132 12/30/23-06:59:32.288100
SID:	2033132
Source Port:	49918
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749906193542033132 12/30/23-06:59:25.530242
SID:	2033132
Source Port:	49906
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850007193542033132 12/30/23-07:00:17.003332
SID:	2033132
Source Port:	50007
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749904193542033132 12/30/23-06:59:24.562802
SID:	2033132
Source Port:	49904
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749914193542033132 12/30/23-06:59:30.329855
SID:	2033132
Source Port:	49914
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850009193542033132 12/30/23-07:00:17.992635
SID:	2033132
Source Port:	50009
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949820193542814856 12/30/23-06:58:41.006653
SID:	2814856
Source Port:	49820
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949775193542033132 12/30/23-06:58:11.898804
SID:	2033132
Source Port:	49775
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749916193542033132 12/30/23-06:59:31.315995
SID:	2033132
Source Port:	49916
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949764193542033132 12/30/23-06:57:59.930348
SID:	2033132
Source Port:	49764
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749900193542033132 12/30/23-06:59:22.575675
SID:	2033132
Source Port:	49900
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749921193542033132 12/30/23-06:59:33.759908
SID:	2033132
Source Port:	49921
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749902193542033132 12/30/23-06:59:23.554900
SID:	2033132
Source Port:	49902
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949766193542033132 12/30/23-06:58:02.485767
SID:	2033132
Source Port:	49766
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949787193542033132 12/30/23-06:58:21.859503
SID:	2033132
Source Port:	49787
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949811193542814856 12/30/23-06:58:36.302287
SID:	2814856
Source Port:	49811
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749923193542033132 12/30/23-06:59:34.726286
SID:	2033132
Source Port:	49923
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949768193542033132 12/30/23-06:58:04.876943
SID:	2033132
Source Port:	49768
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949789193542033132 12/30/23-06:58:23.169791
SID:	2033132
Source Port:	49789
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949834193542814856 12/30/23-06:58:48.171147
SID:	2814856
Source Port:	49834
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949813193542814856 12/30/23-06:58:37.354950
SID:	2814856
Source Port:	49813
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949815193542814856 12/30/23-06:58:38.422230
SID:	2814856
Source Port:	49815
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949836193542814856 12/30/23-06:58:49.179643
SID:	2814856
Source Port:	49836
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949817193542814856 12/30/23-06:58:39.473534
SID:	2814856
Source Port:	49817
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949838193542814856 12/30/23-06:58:50.173808
SID:	2814856
Source Port:	49838
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949843193542033132 12/30/23-06:58:53.218383
SID:	2033132
Source Port:	49843
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550066193542033132 12/30/23-07:00:46.770843
SID:	2033132
Source Port:	50066
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749879193542814856 12/30/23-06:59:12.631314
SID:	2814856
Source Port:	49879
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850010193542033132 12/30/23-07:00:18.477026
SID:	2033132
Source Port:	50010
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949845193542033132 12/30/23-06:58:54.222789
SID:	2033132
Source Port:	49845
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949819193542814856 12/30/23-06:58:40.501000
SID:	2814856
Source Port:	49819
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550064193542033132 12/30/23-07:00:45.792625
SID:	2033132
Source Port:	50064
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949847193542033132 12/30/23-06:58:55.219909
SID:	2033132
Source Port:	49847
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749875193542814856 12/30/23-06:59:09.576470
SID:	2814856
Source Port:	49875
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749896193542814856 12/30/23-06:59:20.882239
SID:	2814856
Source Port:	49896
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749877193542814856 12/30/23-06:59:11.657337
SID:	2814856
Source Port:	49877
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749898193542814856 12/30/23-06:59:21.850035
SID:	2814856
Source Port:	49898
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550068193542033132 12/30/23-07:00:47.740606
SID:	2033132
Source Port:	50068
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949795193542033132 12/30/23-06:58:26.878298
SID:	2033132
Source Port:	49795
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749932193542033132 12/30/23-06:59:39.117147
SID:	2033132
Source Port:	49932
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749756193542814856 12/30/23-06:57:48.292899
SID:	2814856
Source Port:	49756
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949794193542033132 12/30/23-06:58:26.283659
SID:	2033132
Source Port:	49794
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949798193542033132 12/30/23-06:58:28.628830
SID:	2033132
Source Port:	49798
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949791193542033132 12/30/23-06:58:24.422556
SID:	2033132
Source Port:	49791
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949799193542033132 12/30/23-06:58:29.212613
SID:	2033132
Source Port:	49799
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749906193542814856 12/30/23-06:59:25.770785
SID:	2814856
Source Port:	49906
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749752193542814856 12/30/23-06:57:39.966123
SID:	2814856
Source Port:	49752
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749751193542814856 12/30/23-06:57:37.519223
SID:	2814856
Source Port:	49751
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749759193542814856 12/30/23-06:57:51.839689
SID:	2814856
Source Port:	49759
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949801193542814856 12/30/23-06:58:30.584406
SID:	2814856
Source Port:	49801
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949802193542814856 12/30/23-06:58:31.147560
SID:	2814856
Source Port:	49802
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749907193542814856 12/30/23-06:59:26.275930
SID:	2814856
Source Port:	49907
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749933193542033132 12/30/23-06:59:39.601760
SID:	2033132
Source Port:	49933
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749873193542814856 12/30/23-06:59:08.594471
SID:	2814856
Source Port:	49873
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949764193542814856 12/30/23-06:58:00.172622
SID:	2814856
Source Port:	49764
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949765193542814856 12/30/23-06:58:01.473265
SID:	2814856
Source Port:	49765
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749902193542814856 12/30/23-06:59:23.793402
SID:	2814856
Source Port:	49902
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850015193542033132 12/30/23-07:00:21.543091
SID:	2033132
Source Port:	50015
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749872193542814856 12/30/23-06:59:08.108252
SID:	2814856
Source Port:	49872
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850014193542033132 12/30/23-07:00:20.575513
SID:	2033132
Source Port:	50014
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949790193542033132 12/30/23-06:58:23.797823
SID:	2033132
Source Port:	49790
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749899193542033132 12/30/23-06:59:22.091446
SID:	2033132
Source Port:	49899
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850011193542033132 12/30/23-07:00:18.962037
SID:	2033132
Source Port:	50011
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949831193542033132 12/30/23-06:58:46.408297
SID:	2033132
Source Port:	49831
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749755193542814856 12/30/23-06:57:46.372600
SID:	2814856
Source Port:	49755
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949832193542033132 12/30/23-06:58:46.906902
SID:	2033132
Source Port:	49832
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949805193542814856 12/30/23-06:58:32.805845
SID:	2814856
Source Port:	49805
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949806193542814856 12/30/23-06:58:33.355460
SID:	2814856
Source Port:	49806
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749903193542814856 12/30/23-06:59:24.315420
SID:	2814856
Source Port:	49903
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550060193542033132 12/30/23-07:00:43.834106
SID:	2033132
Source Port:	50060
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749929193542033132 12/30/23-06:59:37.653403
SID:	2033132
Source Port:	49929
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850018193542033132 12/30/23-07:00:22.786929
SID:	2033132
Source Port:	50018
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850029193542033132 12/30/23-07:00:28.229769
SID:	2033132
Source Port:	50029
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949779193542814856 12/30/23-06:58:15.792812
SID:	2814856
Source Port:	49779
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749936193542033132 12/30/23-06:59:41.043152
SID:	2033132
Source Port:	49936
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949768193542814856 12/30/23-06:58:05.118313
SID:	2814856
Source Port:	49768
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949769193542814856 12/30/23-06:58:06.230283
SID:	2814856
Source Port:	49769
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749925193542033132 12/30/23-06:59:35.700120
SID:	2033132
Source Port:	49925
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749926193542033132 12/30/23-06:59:36.181869
SID:	2033132
Source Port:	49926
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850019193542033132 12/30/23-07:00:23.274007
SID:	2033132
Source Port:	50019
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949785193542033132 12/30/23-06:58:20.502867
SID:	2033132
Source Port:	49785
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749937193542033132 12/30/23-06:59:41.527798
SID:	2033132
Source Port:	49937
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949784193542033132 12/30/23-06:58:19.803732
SID:	2033132
Source Port:	49784
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749745193542814856 12/30/23-06:57:21.884586
SID:	2814856
Source Port:	49745
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949780193542033132 12/30/23-06:58:16.840242
SID:	2033132
Source Port:	49780
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949781193542033132 12/30/23-06:58:17.605537
SID:	2033132
Source Port:	49781
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749741193542814856 12/30/23-06:57:11.514602
SID:	2814856
Source Port:	49741
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749749193542814856 12/30/23-06:57:32.353860
SID:	2814856
Source Port:	49749
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749761193542814856 12/30/23-06:57:55.069798
SID:	2814856
Source Port:	49761
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949776193542814856 12/30/23-06:58:13.018301
SID:	2814856
Source Port:	49776
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749748193542814856 12/30/23-06:57:29.753082
SID:	2814856
Source Port:	49748
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949775193542814856 12/30/23-06:58:12.140545
SID:	2814856
Source Port:	49775
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850005193542033132 12/30/23-07:00:16.032843
SID:	2033132
Source Port:	50005
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850026193542033132 12/30/23-07:00:26.716616
SID:	2033132
Source Port:	50026
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749862193542814856 12/30/23-06:59:03.086640
SID:	2814856
Source Port:	49862
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550070193542033132 12/30/23-07:00:48.719328
SID:	2033132
Source Port:	50070
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749883193542814856 12/30/23-06:59:14.575085
SID:	2814856
Source Port:	49883
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749861193542814856 12/30/23-06:59:02.584434
SID:	2814856
Source Port:	49861
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850004193542033132 12/30/23-07:00:15.549435
SID:	2033132
Source Port:	50004
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850025193542033132 12/30/23-07:00:26.230594
SID:	2033132
Source Port:	50025
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749882193542814856 12/30/23-06:59:14.082439
SID:	2814856
Source Port:	49882
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949771193542814856 12/30/23-06:58:08.334196
SID:	2814856
Source Port:	49771
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850001193542033132 12/30/23-07:00:14.107818
SID:	2033132
Source Port:	50001
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850022193542033132 12/30/23-07:00:24.731564
SID:	2033132
Source Port:	50022
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550073193542033132 12/30/23-07:00:50.186982
SID:	2033132
Source Port:	50073
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949772193542814856 12/30/23-06:58:09.337276
SID:	2814856
Source Port:	49772
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749744193542814856 12/30/23-06:57:19.294692
SID:	2814856
Source Port:	49744
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850059193542814856 12/30/23-07:00:43.466411
SID:	2814856
Source Port:	50059
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550077193542033132 12/30/23-07:00:52.186665
SID:	2033132
Source Port:	50077
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949814193542033132 12/30/23-06:58:37.646709
SID:	2033132
Source Port:	49814
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949835193542033132 12/30/23-06:58:48.442153
SID:	2033132
Source Port:	49835
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749892193542033132 12/30/23-06:59:18.710203
SID:	2033132
Source Port:	49892
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850058193542814856 12/30/23-07:00:42.973648
SID:	2814856
Source Port:	50058
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550078193542033132 12/30/23-07:00:52.683987
SID:	2033132
Source Port:	50078
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749891193542033132 12/30/23-06:59:18.218918
SID:	2033132
Source Port:	49891
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749895193542033132 12/30/23-06:59:20.153537
SID:	2033132
Source Port:	49895
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749869193542814856 12/30/23-06:59:06.630731
SID:	2814856
Source Port:	49869
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850000193542033132 12/30/23-07:00:13.595230
SID:	2033132
Source Port:	50000
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850021193542033132 12/30/23-07:00:24.247127
SID:	2033132
Source Port:	50021
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749896193542033132 12/30/23-06:59:20.640929
SID:	2033132
Source Port:	49896
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550074193542033132 12/30/23-07:00:50.682277
SID:	2033132
Source Port:	50074
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949815193542033132 12/30/23-06:58:38.185220
SID:	2033132
Source Port:	49815
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949836193542033132 12/30/23-06:58:48.938117
SID:	2033132
Source Port:	49836
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949809193542814856 12/30/23-06:58:35.250061
SID:	2814856
Source Port:	49809
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749920193542814856 12/30/23-06:59:33.515224
SID:	2814856
Source Port:	49920
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749865193542814856 12/30/23-06:59:04.588452
SID:	2814856
Source Port:	49865
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749886193542814856 12/30/23-06:59:16.032780
SID:	2814856
Source Port:	49886
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749866193542814856 12/30/23-06:59:05.087576
SID:	2814856
Source Port:	49866
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850055193542814856 12/30/23-07:00:41.504089
SID:	2814856
Source Port:	50055
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949839193542033132 12/30/23-06:58:50.449348
SID:	2033132
Source Port:	49839
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749887193542814856 12/30/23-06:59:16.514863
SID:	2814856
Source Port:	49887
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949818193542033132 12/30/23-06:58:39.751349
SID:	2033132
Source Port:	49818
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949819193542033132 12/30/23-06:58:40.262690
SID:	2033132
Source Port:	49819
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850054193542814856 12/30/23-07:00:41.016431
SID:	2814856
Source Port:	50054
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749911193542033132 12/30/23-06:59:28.906034
SID:	2033132
Source Port:	49911
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749953193542033132 12/30/23-06:59:49.899296
SID:	2033132
Source Port:	49953
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949774193542033132 12/30/23-06:58:10.980764
SID:	2033132
Source Port:	49774
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949770193542033132 12/30/23-06:58:07.067339
SID:	2033132
Source Port:	49770
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949778193542033132 12/30/23-06:58:14.453525
SID:	2033132
Source Port:	49778
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749927193542814856 12/30/23-06:59:36.906209
SID:	2814856
Source Port:	49927
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849977193542033132 12/30/23-07:00:01.827518
SID:	2033132
Source Port:	49977
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749730193542814856 12/30/23-06:56:58.554147
SID:	2814856
Source Port:	49730
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949823193542814856 12/30/23-06:58:42.580546
SID:	2814856
Source Port:	49823
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749923193542814856 12/30/23-06:59:34.964003
SID:	2814856
Source Port:	49923
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550080193542033132 12/30/23-07:00:53.665144
SID:	2033132
Source Port:	50080
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749851193542814856 12/30/23-06:58:57.593735
SID:	2814856
Source Port:	49851
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949786193542814856 12/30/23-06:58:21.432065
SID:	2814856
Source Port:	49786
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849973193542033132 12/30/23-06:59:59.823165
SID:	2033132
Source Port:	49973
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749878193542033132 12/30/23-06:59:11.903318
SID:	2033132
Source Port:	49878
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849989193542814856 12/30/23-07:00:08.436279
SID:	2814856
Source Port:	49989
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749893193542814856 12/30/23-06:59:19.436193
SID:	2814856
Source Port:	49893
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850036193542033132 12/30/23-07:00:31.626776
SID:	2033132
Source Port:	50036
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949782193542814856 12/30/23-06:58:18.587636
SID:	2814856
Source Port:	49782
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749760193542033132 12/30/23-06:57:53.252164
SID:	2033132
Source Port:	49760
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949811193542033132 12/30/23-06:58:36.061798
SID:	2033132
Source Port:	49811
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949827193542814856 12/30/23-06:58:44.610808
SID:	2814856
Source Port:	49827
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849995193542814856 12/30/23-07:00:11.352583
SID:	2814856
Source Port:	49995
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849985193542814856 12/30/23-07:00:06.458086
SID:	2814856
Source Port:	49985
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849981193542814856 12/30/23-07:00:04.500208
SID:	2814856
Source Port:	49981
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849991193542814856 12/30/23-07:00:09.404969
SID:	2814856
Source Port:	49991
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849999193542814856 12/30/23-07:00:13.331950
SID:	2814856
Source Port:	49999
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749909193542033132 12/30/23-06:59:27.121367
SID:	2033132
Source Port:	49909
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749919193542033132 12/30/23-06:59:32.776505
SID:	2033132
Source Port:	49919
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850008193542033132 12/30/23-07:00:17.503665
SID:	2033132
Source Port:	50008
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749957193542033132 12/30/23-06:59:51.858230
SID:	2033132
Source Port:	49957
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749915193542033132 12/30/23-06:59:30.824594
SID:	2033132
Source Port:	49915
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749947193542033132 12/30/23-06:59:46.987477
SID:	2033132
Source Port:	49947
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749905193542033132 12/30/23-06:59:25.049008
SID:	2033132
Source Port:	49905
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749964193542033132 12/30/23-06:59:55.271906
SID:	2033132
Source Port:	49964
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749922193542033132 12/30/23-06:59:34.244220
SID:	2033132
Source Port:	49922
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749943193542033132 12/30/23-06:59:44.719248
SID:	2033132
Source Port:	49943
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849987193542033132 12/30/23-07:00:07.206315
SID:	2033132
Source Port:	49987
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949767193542033132 12/30/23-06:58:03.713667
SID:	2033132
Source Port:	49767
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949788193542033132 12/30/23-06:58:22.517327
SID:	2033132
Source Port:	49788
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749959193542814856 12/30/23-06:59:53.069861
SID:	2814856
Source Port:	49959
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849966193542033132 12/30/23-06:59:56.364852
SID:	2033132
Source Port:	49966
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949833193542814856 12/30/23-06:58:47.656166
SID:	2814856
Source Port:	49833
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749938193542814856 12/30/23-06:59:42.272685
SID:	2814856
Source Port:	49938
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949812193542814856 12/30/23-06:58:36.835456
SID:	2814856
Source Port:	49812
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749901193542033132 12/30/23-06:59:23.075689
SID:	2033132
Source Port:	49901
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749917193542814856 12/30/23-06:59:32.043952
SID:	2814856
Source Port:	49917
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749955193542814856 12/30/23-06:59:51.120533
SID:	2814856
Source Port:	49955
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749868193542033132 12/30/23-06:59:05.905389
SID:	2033132
Source Port:	49868
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749889193542033132 12/30/23-06:59:17.247936
SID:	2033132
Source Port:	49889
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949837193542814856 12/30/23-06:58:49.679623
SID:	2814856
Source Port:	49837
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749934193542814856 12/30/23-06:59:40.323985
SID:	2814856
Source Port:	49934
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849978193542814856 12/30/23-07:00:02.576014
SID:	2814856
Source Port:	49978
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849983193542033132 12/30/23-07:00:05.234340
SID:	2033132
Source Port:	49983
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749960193542033132 12/30/23-06:59:53.321128
SID:	2033132
Source Port:	49960
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949842193542033132 12/30/23-06:58:52.917769
SID:	2033132
Source Port:	49842
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949800193542033132 12/30/23-06:58:29.782591
SID:	2033132
Source Port:	49800
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949816193542814856 12/30/23-06:58:38.952892
SID:	2814856
Source Port:	49816
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949821193542033132 12/30/23-06:58:41.279188
SID:	2033132
Source Port:	49821
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749913193542814856 12/30/23-06:59:30.084234
SID:	2814856
Source Port:	49913
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850006193542814856 12/30/23-07:00:16.760624
SID:	2814856
Source Port:	50006
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749859193542814856 12/30/23-06:59:01.585982
SID:	2814856
Source Port:	49859
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850048193542814856 12/30/23-07:00:37.736713
SID:	2814856
Source Port:	50048
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550067193542033132 12/30/23-07:00:47.256829
SID:	2033132
Source Port:	50067
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749860193542033132 12/30/23-06:59:01.845457
SID:	2033132
Source Port:	49860
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749881193542033132 12/30/23-06:59:13.355381
SID:	2033132
Source Port:	49881
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949846193542033132 12/30/23-06:58:54.722012
SID:	2033132
Source Port:	49846
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850027193542814856 12/30/23-07:00:27.496245
SID:	2814856
Source Port:	50027
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850032193542033132 12/30/23-07:00:29.691730
SID:	2033132
Source Port:	50032
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749951193542814856 12/30/23-06:59:49.163586
SID:	2814856
Source Port:	49951
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850002193542814856 12/30/23-07:00:14.817994
SID:	2814856
Source Port:	50002
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550063193542033132 12/30/23-07:00:45.301340
SID:	2033132
Source Port:	50063
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749864193542033132 12/30/23-06:59:03.844410
SID:	2033132
Source Port:	49864
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749885193542033132 12/30/23-06:59:15.300659
SID:	2033132
Source Port:	49885
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850053193542033132 12/30/23-07:00:40.266642
SID:	2033132
Source Port:	50053
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749930193542814856 12/30/23-06:59:38.383930
SID:	2814856
Source Port:	49930
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949804193542033132 12/30/23-06:58:32.016402
SID:	2033132
Source Port:	49804
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949825193542033132 12/30/23-06:58:43.358709
SID:	2033132
Source Port:	49825
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850040193542814856 12/30/23-07:00:33.829919
SID:	2814856
Source Port:	50040
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749897193542814856 12/30/23-06:59:21.371867
SID:	2814856
Source Port:	49897
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850023193542814856 12/30/23-07:00:25.504623
SID:	2814856
Source Port:	50023
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850044193542814856 12/30/23-07:00:35.791284
SID:	2814856
Source Port:	50044
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749855193542814856 12/30/23-06:58:59.561215
SID:	2814856
Source Port:	49855
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749747193542033132 12/30/23-06:57:26.909123
SID:	2033132
Source Port:	49747
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949808193542033132 12/30/23-06:58:34.389036
SID:	2033132
Source Port:	49808
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949829193542033132 12/30/23-06:58:45.412490
SID:	2033132
Source Port:	49829
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849998193542033132 12/30/23-07:00:12.595313
SID:	2033132
Source Port:	49998
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749741193542033132 12/30/23-06:57:11.270022
SID:	2033132
Source Port:	49741
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749948193542814856 12/30/23-06:59:47.711739
SID:	2814856
Source Port:	49948
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749949193542814856 12/30/23-06:59:48.194602
SID:	2814856
Source Port:	49949
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749743193542033132 12/30/23-06:57:16.443459
SID:	2033132
Source Port:	49743
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849999193542033132 12/30/23-07:00:13.088344
SID:	2033132
Source Port:	49999
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749742193542033132 12/30/23-06:57:13.847951
SID:	2033132
Source Port:	49742
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749944193542814856 12/30/23-06:59:45.216851
SID:	2814856
Source Port:	49944
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849993193542033132 12/30/23-07:00:10.142760
SID:	2033132
Source Port:	49993
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850058193542033132 12/30/23-07:00:42.731334
SID:	2033132
Source Port:	50058
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749943193542814856 12/30/23-06:59:44.723176
SID:	2814856
Source Port:	49943
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749945193542814856 12/30/23-06:59:46.180591
SID:	2814856
Source Port:	49945
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850057193542033132 12/30/23-07:00:42.242902
SID:	2033132
Source Port:	50057
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850059193542033132 12/30/23-07:00:43.221744
SID:	2033132
Source Port:	50059
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749857193542033132 12/30/23-06:59:00.347550
SID:	2033132
Source Port:	49857
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749859193542033132 12/30/23-06:59:01.345120
SID:	2033132
Source Port:	49859
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849994193542033132 12/30/23-07:00:10.626827
SID:	2033132
Source Port:	49994
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749856193542033132 12/30/23-06:58:59.842821
SID:	2033132
Source Port:	49856
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849967193542814856 12/30/23-06:59:57.092698
SID:	2814856
Source Port:	49967
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849997193542033132 12/30/23-07:00:12.105095
SID:	2033132
Source Port:	49997
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850054193542033132 12/30/23-07:00:40.775184
SID:	2033132
Source Port:	50054
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749947193542814856 12/30/23-06:59:47.226861
SID:	2814856
Source Port:	49947
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850055193542033132 12/30/23-07:00:41.261760
SID:	2033132
Source Port:	50055
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849968193542814856 12/30/23-06:59:57.609467
SID:	2814856
Source Port:	49968
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749946193542814856 12/30/23-06:59:46.733187
SID:	2814856
Source Port:	49946
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849995193542033132 12/30/23-07:00:11.110412
SID:	2033132
Source Port:	49995
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850056193542033132 12/30/23-07:00:41.748672
SID:	2033132
Source Port:	50056
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849996193542033132 12/30/23-07:00:11.636031
SID:	2033132
Source Port:	49996
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749858193542033132 12/30/23-06:59:00.844263
SID:	2033132
Source Port:	49858
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849969193542814856 12/30/23-06:59:58.095277
SID:	2814856
Source Port:	49969
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850029193542814856 12/30/23-07:00:28.466902
SID:	2814856
Source Port:	50029
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849973193542814856 12/30/23-07:00:00.069190
SID:	2814856
Source Port:	49973
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849970193542814856 12/30/23-06:59:58.576787
SID:	2814856
Source Port:	49970
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849974193542814856 12/30/23-07:00:00.562308
SID:	2814856
Source Port:	49974
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849977193542814856 12/30/23-07:00:02.069880
SID:	2814856
Source Port:	49977
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749747193542825564 12/30/23-06:57:27.233979
SID:	2825564
Source Port:	49747
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849966193542814856 12/30/23-06:59:56.605198
SID:	2814856
Source Port:	49966
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849975193542814856 12/30/23-07:00:01.086540
SID:	2814856
Source Port:	49975
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849991193542033132 12/30/23-07:00:09.163787
SID:	2033132
Source Port:	49991
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849976193542814856 12/30/23-07:00:01.573004
SID:	2814856
Source Port:	49976
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849992193542033132 12/30/23-07:00:09.652740
SID:	2033132
Source Port:	49992
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849965193542814856 12/30/23-06:59:56.116605
SID:	2814856
Source Port:	49965
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849990193542033132 12/30/23-07:00:08.679646
SID:	2033132
Source Port:	49990
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849971193542814856 12/30/23-06:59:59.069362
SID:	2814856
Source Port:	49971
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849972193542814856 12/30/23-06:59:59.556918
SID:	2814856
Source Port:	49972
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749751193542033132 12/30/23-06:57:37.279473
SID:	2033132
Source Port:	49751
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749730193542033132 12/30/23-06:56:58.314971
SID:	2033132
Source Port:	49730
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749731193542033132 12/30/23-06:57:00.892532
SID:	2033132
Source Port:	49731
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949799193542814856 12/30/23-06:58:29.449482
SID:	2814856
Source Port:	49799
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749752193542033132 12/30/23-06:57:39.791208
SID:	2033132
Source Port:	49752
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949798193542814856 12/30/23-06:58:28.873869
SID:	2814856
Source Port:	49798
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850049193542033132 12/30/23-07:00:38.002839
SID:	2033132
Source Port:	50049
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749732193542033132 12/30/23-06:57:03.485136
SID:	2033132
Source Port:	49732
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749753193542033132 12/30/23-06:57:41.950785
SID:	2033132
Source Port:	49753
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949796193542814856 12/30/23-06:58:27.711457
SID:	2814856
Source Port:	49796
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850047193542033132 12/30/23-07:00:37.016103
SID:	2033132
Source Port:	50047
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949797193542814856 12/30/23-06:58:28.289196
SID:	2814856
Source Port:	49797
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850046193542033132 12/30/23-07:00:36.524654
SID:	2033132
Source Port:	50046
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850048193542033132 12/30/23-07:00:37.496687
SID:	2033132
Source Port:	50048
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949795193542814856 12/30/23-06:58:27.120834
SID:	2814856
Source Port:	49795
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850043193542033132 12/30/23-07:00:35.064965
SID:	2033132
Source Port:	50043
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850044193542033132 12/30/23-07:00:35.550765
SID:	2033132
Source Port:	50044
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749750193542033132 12/30/23-06:57:34.687734
SID:	2033132
Source Port:	49750
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949793193542814856 12/30/23-06:58:25.915869
SID:	2814856
Source Port:	49793
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850019193542814856 12/30/23-07:00:23.516431
SID:	2814856
Source Port:	50019
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850045193542033132 12/30/23-07:00:36.039234
SID:	2033132
Source Port:	50045
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850018193542814856 12/30/23-07:00:23.027394
SID:	2814856
Source Port:	50018
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949794193542814856 12/30/23-06:58:26.526085
SID:	2814856
Source Port:	49794
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749849193542814856 12/30/23-06:58:56.589692
SID:	2814856
Source Port:	49849
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850017193542814856 12/30/23-07:00:22.536265
SID:	2814856
Source Port:	50017
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850038193542814856 12/30/23-07:00:32.847377
SID:	2814856
Source Port:	50038
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749871193542033132 12/30/23-06:59:07.380827
SID:	2033132
Source Port:	49871
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749872193542033132 12/30/23-06:59:07.866667
SID:	2033132
Source Port:	49872
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749848193542814856 12/30/23-06:58:56.080050
SID:	2814856
Source Port:	49848
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850037193542814856 12/30/23-07:00:32.357774
SID:	2814856
Source Port:	50037
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850039193542814856 12/30/23-07:00:33.338541
SID:	2814856
Source Port:	50039
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749851193542033132 12/30/23-06:58:57.350136
SID:	2033132
Source Port:	49851
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850040193542033132 12/30/23-07:00:33.587063
SID:	2033132
Source Port:	50040
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749870193542033132 12/30/23-06:59:06.892440
SID:	2033132
Source Port:	49870
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749873193542033132 12/30/23-06:59:08.354127
SID:	2033132
Source Port:	49873
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749874193542033132 12/30/23-06:59:08.860526
SID:	2033132
Source Port:	49874
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850016193542814856 12/30/23-07:00:22.047418
SID:	2814856
Source Port:	50016
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949792193542814856 12/30/23-06:58:25.292661
SID:	2814856
Source Port:	49792
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749852193542033132 12/30/23-06:58:57.840227
SID:	2033132
Source Port:	49852
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749940193542814856 12/30/23-06:59:43.253908
SID:	2814856
Source Port:	49940
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850013193542814856 12/30/23-07:00:20.180218
SID:	2814856
Source Port:	50013
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850034193542814856 12/30/23-07:00:30.897052
SID:	2814856
Source Port:	50034
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749875193542033132 12/30/23-06:59:09.335661
SID:	2033132
Source Port:	49875
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749876193542033132 12/30/23-06:59:11.164509
SID:	2033132
Source Port:	49876
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749941193542814856 12/30/23-06:59:43.737971
SID:	2814856
Source Port:	49941
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749962193542814856 12/30/23-06:59:54.541480
SID:	2814856
Source Port:	49962
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850035193542814856 12/30/23-07:00:31.380008
SID:	2814856
Source Port:	50035
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949791193542814856 12/30/23-06:58:24.664666
SID:	2814856
Source Port:	49791
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749853193542033132 12/30/23-06:58:58.326027
SID:	2033132
Source Port:	49853
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749855193542033132 12/30/23-06:58:59.316698
SID:	2033132
Source Port:	49855
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850042193542033132 12/30/23-07:00:34.574205
SID:	2033132
Source Port:	50042
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749942193542814856 12/30/23-06:59:44.234619
SID:	2814856
Source Port:	49942
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749963193542814856 12/30/23-06:59:55.027646
SID:	2814856
Source Port:	49963
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850036193542814856 12/30/23-07:00:31.869023
SID:	2814856
Source Port:	50036
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850014193542814856 12/30/23-07:00:20.683832
SID:	2814856
Source Port:	50014
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949790193542814856 12/30/23-06:58:24.039838
SID:	2814856
Source Port:	49790
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749854193542033132 12/30/23-06:58:58.817855
SID:	2033132
Source Port:	49854
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850041193542033132 12/30/23-07:00:34.083405
SID:	2033132
Source Port:	50041
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850030193542814856 12/30/23-07:00:28.954437
SID:	2814856
Source Port:	50030
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749735193542033132 12/30/23-06:57:08.663103
SID:	2033132
Source Port:	49735
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850031193542814856 12/30/23-07:00:29.445787
SID:	2814856
Source Port:	50031
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749754193542033132 12/30/23-06:57:44.074834
SID:	2033132
Source Port:	49754
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749756193542033132 12/30/23-06:57:48.050572
SID:	2033132
Source Port:	49756
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749733193542033132 12/30/23-06:57:06.081901
SID:	2033132
Source Port:	49733
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850012193542814856 12/30/23-07:00:19.695001
SID:	2814856
Source Port:	50012
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749755193542033132 12/30/23-06:57:46.129320
SID:	2033132
Source Port:	49755
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749759193542033132 12/30/23-06:57:51.599816
SID:	2033132
Source Port:	49759
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749729193542814856 12/30/23-06:56:56.048636
SID:	2814856
Source Port:	49729
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749961193542814856 12/30/23-06:59:54.054177
SID:	2814856
Source Port:	49961
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850033193542814856 12/30/23-07:00:30.416672
SID:	2814856
Source Port:	50033
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850011193542814856 12/30/23-07:00:19.203057
SID:	2814856
Source Port:	50011
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850032193542814856 12/30/23-07:00:29.928847
SID:	2814856
Source Port:	50032
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749960193542814856 12/30/23-06:59:53.565099
SID:	2814856
Source Port:	49960
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850010193542814856 12/30/23-07:00:18.717437
SID:	2814856
Source Port:	50010
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749757193542033132 12/30/23-06:57:49.875086
SID:	2033132
Source Port:	49757
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749850193542033132 12/30/23-06:58:56.842955
SID:	2033132
Source Port:	49850
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749952193542033132 12/30/23-06:59:49.412198
SID:	2033132
Source Port:	49952
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749954193542033132 12/30/23-06:59:50.385891
SID:	2033132
Source Port:	49954
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749735193542814856 12/30/23-06:57:08.903912
SID:	2814856
Source Port:	49735
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849976193542033132 12/30/23-07:00:01.334423
SID:	2033132
Source Port:	49976
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749956193542033132 12/30/23-06:59:51.364436
SID:	2033132
Source Port:	49956
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850039193542033132 12/30/23-07:00:33.093585
SID:	2033132
Source Port:	50039
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850050193542814856 12/30/23-07:00:38.709977
SID:	2814856
Source Port:	50050
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949787193542814856 12/30/23-06:58:22.099907
SID:	2814856
Source Port:	49787
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749928193542814856 12/30/23-06:59:37.398460
SID:	2814856
Source Port:	49928
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849978193542033132 12/30/23-07:00:02.331532
SID:	2033132
Source Port:	49978
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749879193542033132 12/30/23-06:59:12.389730
SID:	2033132
Source Port:	49879
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749964193542814856 12/30/23-06:59:55.513903
SID:	2814856
Source Port:	49964
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850035193542033132 12/30/23-07:00:31.140226
SID:	2033132
Source Port:	50035
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850037193542033132 12/30/23-07:00:32.119237
SID:	2033132
Source Port:	50037
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749850193542814856 12/30/23-06:58:57.083342
SID:	2814856
Source Port:	49850
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749877193542033132 12/30/23-06:59:11.416435
SID:	2033132
Source Port:	49877
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749731193542814856 12/30/23-06:57:01.133659
SID:	2814856
Source Port:	49731
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749922193542814856 12/30/23-06:59:34.483645
SID:	2814856
Source Port:	49922
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749926193542814856 12/30/23-06:59:36.421423
SID:	2814856
Source Port:	49926
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949785193542814856 12/30/23-06:58:20.746863
SID:	2814856
Source Port:	49785
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849972193542033132 12/30/23-06:59:59.314289
SID:	2033132
Source Port:	49972
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749761193542033132 12/30/23-06:57:54.828622
SID:	2033132
Source Port:	49761
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949810193542033132 12/30/23-06:58:35.529677
SID:	2033132
Source Port:	49810
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749950193542033132 12/30/23-06:59:48.439896
SID:	2033132
Source Port:	49950
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850033193542033132 12/30/23-07:00:30.175204
SID:	2033132
Source Port:	50033
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749733193542814856 12/30/23-06:57:06.321693
SID:	2814856
Source Port:	49733
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749924193542814856 12/30/23-06:59:35.446750
SID:	2814856
Source Port:	49924
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850007193542814856 12/30/23-07:00:17.242018
SID:	2814856
Source Port:	50007
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949783193542814856 12/30/23-06:58:19.316332
SID:	2814856
Source Port:	49783
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849974193542033132 12/30/23-07:00:00.317197
SID:	2033132
Source Port:	49974
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849984193542814856 12/30/23-07:00:05.970954
SID:	2814856
Source Port:	49984
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849994193542814856 12/30/23-07:00:10.865713
SID:	2814856
Source Port:	49994
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849992193542814856 12/30/23-07:00:09.897175
SID:	2814856
Source Port:	49992
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849996193542814856 12/30/23-07:00:11.851716
SID:	2814856
Source Port:	49996
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850009193542814856 12/30/23-07:00:18.231993
SID:	2814856
Source Port:	50009
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849980193542814856 12/30/23-07:00:04.012515
SID:	2814856
Source Port:	49980
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849988193542814856 12/30/23-07:00:07.946788
SID:	2814856
Source Port:	49988
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849990193542814856 12/30/23-07:00:08.920614
SID:	2814856
Source Port:	49990
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849998193542814856 12/30/23-07:00:12.837253
SID:	2814856
Source Port:	49998
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849980193542033132 12/30/23-07:00:03.827429
SID:	2033132
Source Port:	49980
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849970193542033132 12/30/23-06:59:58.337721
SID:	2033132
Source Port:	49970
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849986193542814856 12/30/23-07:00:06.958269
SID:	2814856
Source Port:	49986
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949789193542814856 12/30/23-06:58:23.407334
SID:	2814856
Source Port:	49789
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749958193542033132 12/30/23-06:59:52.342235
SID:	2033132
Source Port:	49958
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849982193542814856 12/30/23-07:00:04.987660
SID:	2814856
Source Port:	49982
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749948193542033132 12/30/23-06:59:47.472154
SID:	2033132
Source Port:	49948
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849969193542033132 12/30/23-06:59:57.853566
SID:	2033132
Source Port:	49969
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749963193542033132 12/30/23-06:59:54.785800
SID:	2033132
Source Port:	49963
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749942193542033132 12/30/23-06:59:43.992910
SID:	2033132
Source Port:	49942
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749946193542033132 12/30/23-06:59:46.488338
SID:	2033132
Source Port:	49946
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749916193542814856 12/30/23-06:59:31.555556
SID:	2814856
Source Port:	49916
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849988193542033132 12/30/23-07:00:07.700870
SID:	2033132
Source Port:	49988
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749918193542814856 12/30/23-06:59:32.529835
SID:	2814856
Source Port:	49918
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849967193542033132 12/30/23-06:59:56.850603
SID:	2033132
Source Port:	49967
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749939193542814856 12/30/23-06:59:42.759589
SID:	2814856
Source Port:	49939
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749944193542033132 12/30/23-06:59:44.971902
SID:	2033132
Source Port:	49944
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749869193542033132 12/30/23-06:59:06.391520
SID:	2033132
Source Port:	49869
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749912193542814856 12/30/23-06:59:29.607772
SID:	2814856
Source Port:	49912
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749954193542814856 12/30/23-06:59:50.627454
SID:	2814856
Source Port:	49954
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749848193542033132 12/30/23-06:58:55.841355
SID:	2033132
Source Port:	49848
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849982193542033132 12/30/23-07:00:04.772515
SID:	2033132
Source Port:	49982
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849984193542033132 12/30/23-07:00:05.732245
SID:	2033132
Source Port:	49984
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749867193542033132 12/30/23-06:59:05.403704
SID:	2033132
Source Port:	49867
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749888193542033132 12/30/23-06:59:16.761193
SID:	2033132
Source Port:	49888
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749933193542814856 12/30/23-06:59:39.842196
SID:	2814856
Source Port:	49933
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749937193542814856 12/30/23-06:59:41.768490
SID:	2814856
Source Port:	49937
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849965193542033132 12/30/23-06:59:55.878341
SID:	2033132
Source Port:	49965
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949820193542033132 12/30/23-06:58:40.765520
SID:	2033132
Source Port:	49820
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749958193542814856 12/30/23-06:59:52.581860
SID:	2814856
Source Port:	49958
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749961193542033132 12/30/23-06:59:53.811310
SID:	2033132
Source Port:	49961
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849986193542033132 12/30/23-07:00:06.716982
SID:	2033132
Source Port:	49986
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749914193542814856 12/30/23-06:59:30.573264
SID:	2814856
Source Port:	49914
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849979193542814856 12/30/23-07:00:03.071228
SID:	2814856
Source Port:	49979
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949822193542033132 12/30/23-06:58:41.834391
SID:	2033132
Source Port:	49822
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749956193542814856 12/30/23-06:59:51.605514
SID:	2814856
Source Port:	49956
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749935193542814856 12/30/23-06:59:40.802367
SID:	2814856
Source Port:	49935
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749940193542033132 12/30/23-06:59:43.008933
SID:	2033132
Source Port:	49940
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749861193542033132 12/30/23-06:59:02.343732
SID:	2033132
Source Port:	49861
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749882193542033132 12/30/23-06:59:13.841892
SID:	2033132
Source Port:	49882
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850050193542033132 12/30/23-07:00:38.576098
SID:	2033132
Source Port:	50050
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949824193542033132 12/30/23-06:58:42.848389
SID:	2033132
Source Port:	49824
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850049193542814856 12/30/23-07:00:38.223716
SID:	2814856
Source Port:	50049
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949801193542033132 12/30/23-06:58:30.343483
SID:	2033132
Source Port:	49801
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949803193542033132 12/30/23-06:58:31.468455
SID:	2033132
Source Port:	49803
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850026193542814856 12/30/23-07:00:26.960595
SID:	2814856
Source Port:	50026
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850028193542814856 12/30/23-07:00:27.990273
SID:	2814856
Source Port:	50028
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749858193542814856 12/30/23-06:59:01.085903
SID:	2814856
Source Port:	49858
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749863193542033132 12/30/23-06:59:03.347715
SID:	2033132
Source Port:	49863
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749884193542033132 12/30/23-06:59:14.818821
SID:	2033132
Source Port:	49884
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749880193542033132 12/30/23-06:59:12.872848
SID:	2033132
Source Port:	49880
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850005193542814856 12/30/23-07:00:16.273723
SID:	2814856
Source Port:	50005
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949781193542814856 12/30/23-06:58:17.843270
SID:	2814856
Source Port:	49781
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749865193542033132 12/30/23-06:59:04.346123
SID:	2033132
Source Port:	49865
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749886193542033132 12/30/23-06:59:15.787605
SID:	2033132
Source Port:	49886
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850045193542814856 12/30/23-07:00:36.282306
SID:	2814856
Source Port:	50045
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949805193542033132 12/30/23-06:58:32.563530
SID:	2033132
Source Port:	49805
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850024193542814856 12/30/23-07:00:25.988529
SID:	2814856
Source Port:	50024
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850031193542033132 12/30/23-07:00:29.206057
SID:	2033132
Source Port:	50031
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749910193542814856 12/30/23-06:59:28.641541
SID:	2814856
Source Port:	49910
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850052193542033132 12/30/23-07:00:39.896763
SID:	2033132
Source Port:	50052
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749729193542033132 12/30/23-06:56:55.865512
SID:	2033132
Source Port:	49729
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949826193542033132 12/30/23-06:58:43.862219
SID:	2033132
Source Port:	49826
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749952193542814856 12/30/23-06:59:49.653812
SID:	2814856
Source Port:	49952
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850047193542814856 12/30/23-07:00:37.254319
SID:	2814856
Source Port:	50047
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850003193542814856 12/30/23-07:00:15.304449
SID:	2814856
Source Port:	50003
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749931193542814856 12/30/23-06:59:38.869094
SID:	2814856
Source Port:	49931
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749852193542814856 12/30/23-06:58:58.076573
SID:	2814856
Source Port:	49852
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850041193542814856 12/30/23-07:00:34.323025
SID:	2814856
Source Port:	50041
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949809193542033132 12/30/23-06:58:35.007968
SID:	2033132
Source Port:	49809
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850020193542814856 12/30/23-07:00:24.001117
SID:	2814856
Source Port:	50020
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749854193542814856 12/30/23-06:58:59.057474
SID:	2814856
Source Port:	49854
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850001193542814856 12/30/23-07:00:14.328187
SID:	2814856
Source Port:	50001
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749744193542033132 12/30/23-06:57:19.050041
SID:	2033132
Source Port:	49744
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749748193542033132 12/30/23-06:57:29.511857
SID:	2033132
Source Port:	49748
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749856193542814856 12/30/23-06:59:00.087695
SID:	2814856
Source Port:	49856
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949828193542033132 12/30/23-06:58:44.882263
SID:	2033132
Source Port:	49828
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749950193542814856 12/30/23-06:59:48.676663
SID:	2814856
Source Port:	49950
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949807193542033132 12/30/23-06:58:34.079878
SID:	2033132
Source Port:	49807
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850022193542814856 12/30/23-07:00:24.973826
SID:	2814856
Source Port:	50022
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850043193542814856 12/30/23-07:00:35.308067
SID:	2814856
Source Port:	50043
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749746193542033132 12/30/23-06:57:24.324942
SID:	2033132
Source Port:	49746
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749757193542814856 12/30/23-06:57:50.114659
SID:	2814856
Source Port:	49757
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749909193542814856 12/30/23-06:59:27.358945
SID:	2814856
Source Port:	49909
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749908193542814856 12/30/23-06:59:26.758826
SID:	2814856
Source Port:	49908
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749931193542033132 12/30/23-06:59:38.628084
SID:	2033132
Source Port:	49931
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749935193542033132 12/30/23-06:59:40.565444
SID:	2033132
Source Port:	49935
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949800193542814856 12/30/23-06:58:30.022010
SID:	2814856
Source Port:	49800
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749905193542814856 12/30/23-06:59:25.286864
SID:	2814856
Source Port:	49905
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949793193542033132 12/30/23-06:58:25.674401
SID:	2033132
Source Port:	49793
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749934193542033132 12/30/23-06:59:40.085126
SID:	2033132
Source Port:	49934
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949766193542814856 12/30/23-06:58:02.727133
SID:	2814856
Source Port:	49766
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850017193542033132 12/30/23-07:00:22.313219
SID:	2033132
Source Port:	50017
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949792193542033132 12/30/23-06:58:25.052320
SID:	2033132
Source Port:	49792
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949803193542814856 12/30/23-06:58:31.707862
SID:	2814856
Source Port:	49803
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949804193542814856 12/30/23-06:58:32.258279
SID:	2814856
Source Port:	49804
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749901193542814856 12/30/23-06:59:23.312951
SID:	2814856
Source Port:	49901
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850016193542033132 12/30/23-07:00:21.897628
SID:	2033132
Source Port:	50016
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749871193542814856 12/30/23-06:59:07.622024
SID:	2814856
Source Port:	49871
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949763193542814856 12/30/23-06:57:58.790672
SID:	2814856
Source Port:	49763
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749900193542814856 12/30/23-06:59:22.817240
SID:	2814856
Source Port:	49900
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749904193542814856 12/30/23-06:59:24.806589
SID:	2814856
Source Port:	49904
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749753193542814856 12/30/23-06:57:42.189827
SID:	2814856
Source Port:	49753
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850012193542033132 12/30/23-07:00:19.451840
SID:	2033132
Source Port:	50012
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550062193542033132 12/30/23-07:00:44.811642
SID:	2033132
Source Port:	50062
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749754193542814856 12/30/23-06:57:44.316818
SID:	2814856
Source Port:	49754
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749870193542814856 12/30/23-06:59:07.134679
SID:	2814856
Source Port:	49870
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749930193542033132 12/30/23-06:59:38.144940
SID:	2033132
Source Port:	49930
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949762193542814856 12/30/23-06:57:56.779496
SID:	2814856
Source Port:	49762
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850013193542033132 12/30/23-07:00:19.939025
SID:	2033132
Source Port:	50013
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550061193542033132 12/30/23-07:00:44.320331
SID:	2033132
Source Port:	50061
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949830193542033132 12/30/23-06:58:45.902361
SID:	2033132
Source Port:	49830
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749760193542814856 12/30/23-06:57:53.493964
SID:	2814856
Source Port:	49760
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749750193542814856 12/30/23-06:57:34.929638
SID:	2814856
Source Port:	49750
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949767193542814856 12/30/23-06:58:03.958715
SID:	2814856
Source Port:	49767
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749928193542033132 12/30/23-06:59:37.157075
SID:	2033132
Source Port:	49928
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949778193542814856 12/30/23-06:58:14.688767
SID:	2814856
Source Port:	49778
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749939193542033132 12/30/23-06:59:42.518313
SID:	2033132
Source Port:	49939
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949786193542033132 12/30/23-06:58:21.190683
SID:	2033132
Source Port:	49786
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949797193542033132 12/30/23-06:58:28.048530
SID:	2033132
Source Port:	49797
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749938193542033132 12/30/23-06:59:42.031161
SID:	2033132
Source Port:	49938
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749927193542033132 12/30/23-06:59:36.665802
SID:	2033132
Source Port:	49927
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949796193542033132 12/30/23-06:58:27.470586
SID:	2033132
Source Port:	49796
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749747193542814856 12/30/23-06:57:27.150655
SID:	2814856
Source Port:	49747
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949783193542033132 12/30/23-06:58:19.076238
SID:	2033132
Source Port:	49783
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749746193542814856 12/30/23-06:57:24.568832
SID:	2814856
Source Port:	49746
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949777193542814856 12/30/23-06:58:13.872631
SID:	2814856
Source Port:	49777
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850028193542033132 12/30/23-07:00:27.745382
SID:	2033132
Source Port:	50028
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949782193542033132 12/30/23-06:58:18.344993
SID:	2033132
Source Port:	49782
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850006193542033132 12/30/23-07:00:16.520244
SID:	2033132
Source Port:	50006
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850027193542033132 12/30/23-07:00:27.255013
SID:	2033132
Source Port:	50027
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850003193542033132 12/30/23-07:00:15.062948
SID:	2033132
Source Port:	50003
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749860193542814856 12/30/23-06:59:02.085316
SID:	2814856
Source Port:	49860
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949774193542814856 12/30/23-06:58:11.217163
SID:	2814856
Source Port:	49774
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749742193542814856 12/30/23-06:57:14.088663
SID:	2814856
Source Port:	49742
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550072193542033132 12/30/23-07:00:49.694789
SID:	2033132
Source Port:	50072
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749743193542814856 12/30/23-06:57:16.689114
SID:	2814856
Source Port:	49743
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749881193542814856 12/30/23-06:59:13.594722
SID:	2814856
Source Port:	49881
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949773193542814856 12/30/23-06:58:10.300191
SID:	2814856
Source Port:	49773
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850024193542033132 12/30/23-07:00:25.751103
SID:	2033132
Source Port:	50024
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550071193542033132 12/30/23-07:00:49.200940
SID:	2033132
Source Port:	50071
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850002193542033132 12/30/23-07:00:14.574938
SID:	2033132
Source Port:	50002
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850023193542033132 12/30/23-07:00:25.261896
SID:	2033132
Source Port:	50023
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749880193542814856 12/30/23-06:59:13.111628
SID:	2814856
Source Port:	49880
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949813193542033132 12/30/23-06:58:37.111513
SID:	2033132
Source Port:	49813
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949834193542033132 12/30/23-06:58:47.933226
SID:	2033132
Source Port:	49834
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749893193542033132 12/30/23-06:59:19.207463
SID:	2033132
Source Port:	49893
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949812193542033132 12/30/23-06:58:36.594044
SID:	2033132
Source Port:	49812
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949833193542033132 12/30/23-06:58:47.410751
SID:	2033132
Source Port:	49833
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749894193542033132 12/30/23-06:59:19.676849
SID:	2033132
Source Port:	49894
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550076193542033132 12/30/23-07:00:51.670271
SID:	2033132
Source Port:	50076
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749868193542814856 12/30/23-06:59:06.145562
SID:	2814856
Source Port:	49868
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949770193542814856 12/30/23-06:58:07.306224
SID:	2814856
Source Port:	49770
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949838193542033132 12/30/23-06:58:49.935180
SID:	2033132
Source Port:	49838
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749897193542033132 12/30/23-06:59:21.130355
SID:	2033132
Source Port:	49897
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949808193542814856 12/30/23-06:58:34.624993
SID:	2814856
Source Port:	49808
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949816193542033132 12/30/23-06:58:38.707245
SID:	2033132
Source Port:	49816
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949837193542033132 12/30/23-06:58:49.437993
SID:	2033132
Source Port:	49837
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749890193542033132 12/30/23-06:59:17.730882
SID:	2033132
Source Port:	49890
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749898193542033132 12/30/23-06:59:21.612585
SID:	2033132
Source Port:	49898
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850056193542814856 12/30/23-07:00:41.990891
SID:	2814856
Source Port:	50056
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749921193542814856 12/30/23-06:59:34.001695
SID:	2814856
Source Port:	49921
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850020193542033132 12/30/23-07:00:23.762339
SID:	2033132
Source Port:	50020
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850057193542814856 12/30/23-07:00:42.486869
SID:	2814856
Source Port:	50057
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550075193542033132 12/30/23-07:00:51.177057
SID:	2033132
Source Port:	50075
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749884193542814856 12/30/23-06:59:15.059251
SID:	2814856
Source Port:	49884
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749863193542814856 12/30/23-06:59:03.591806
SID:	2814856
Source Port:	49863
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850052193542814856 12/30/23-07:00:40.013512
SID:	2814856
Source Port:	50052
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749885193542814856 12/30/23-06:59:15.538707
SID:	2814856
Source Port:	49885
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749864193542814856 12/30/23-06:59:04.086040
SID:	2814856
Source Port:	49864
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749747193542814860 12/30/23-06:57:27.233979
SID:	2814860
Source Port:	49747
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949817193542033132 12/30/23-06:58:39.233276
SID:	2033132
Source Port:	49817
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749867193542814856 12/30/23-06:59:05.648160
SID:	2814856
Source Port:	49867
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749889193542814856 12/30/23-06:59:17.489613
SID:	2814856
Source Port:	49889
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550079193542033132 12/30/23-07:00:53.177189
SID:	2033132
Source Port:	50079
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850053193542814856 12/30/23-07:00:40.509000
SID:	2814856
Source Port:	50053
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749888193542814856 12/30/23-06:59:17.003077
SID:	2814856
Source Port:	49888
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749929193542814856 12/30/23-06:59:37.897152
SID:	2814856
Source Port:	49929
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849979193542033132 12/30/23-07:00:02.833960
SID:	2033132
Source Port:	49979
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749913193542033132 12/30/23-06:59:29.847668
SID:	2033132
Source Port:	49913
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949772193542033132 12/30/23-06:58:09.095731
SID:	2033132
Source Port:	49772
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949776193542033132 12/30/23-06:58:12.779493
SID:	2033132
Source Port:	49776
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949788193542814856 12/30/23-06:58:22.759732
SID:	2814856
Source Port:	49788
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749955193542033132 12/30/23-06:59:50.878260
SID:	2033132
Source Port:	49955
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850038193542033132 12/30/23-07:00:32.609416
SID:	2033132
Source Port:	50038
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949825193542814856 12/30/23-06:58:43.598734
SID:	2814856
Source Port:	49825
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849971193542033132 12/30/23-06:59:58.824501
SID:	2033132
Source Port:	49971
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949784193542814856 12/30/23-06:58:20.048612
SID:	2814856
Source Port:	49784
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749732193542814856 12/30/23-06:57:03.726887
SID:	2814856
Source Port:	49732
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949829193542814856 12/30/23-06:58:45.628952
SID:	2814856
Source Port:	49829
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849975193542033132 12/30/23-07:00:00.846778
SID:	2033132
Source Port:	49975
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749925193542814856 12/30/23-06:59:35.937314
SID:	2814856
Source Port:	49925
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749951193542033132 12/30/23-06:59:48.922026
SID:	2033132
Source Port:	49951
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850008193542814856 12/30/23-07:00:17.739937
SID:	2814856
Source Port:	50008
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550082193542033132 12/30/23-07:00:57.990897
SID:	2033132
Source Port:	50082
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749891193542814856 12/30/23-06:59:18.463462
SID:	2814856
Source Port:	49891
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850034193542033132 12/30/23-07:00:30.660872
SID:	2033132
Source Port:	50034
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849987193542814856 12/30/23-07:00:07.450556
SID:	2814856
Source Port:	49987
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949840193542033132 12/30/23-06:58:51.058204
SID:	2033132
Source Port:	49840
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849997193542814856 12/30/23-07:00:12.349998
SID:	2814856
Source Port:	49997
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849981193542033132 12/30/23-07:00:04.257676
SID:	2033132
Source Port:	49981
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749949193542033132 12/30/23-06:59:47.956084
SID:	2033132
Source Port:	49949
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749917193542033132 12/30/23-06:59:31.804979
SID:	2033132
Source Port:	49917
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749907193542033132 12/30/23-06:59:26.034167
SID:	2033132
Source Port:	49907
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949821193542814856 12/30/23-06:58:41.518023
SID:	2814856
Source Port:	49821
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949810193542814856 12/30/23-06:58:35.769712
SID:	2814856
Source Port:	49810
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749959193542033132 12/30/23-06:59:52.826362
SID:	2033132
Source Port:	49959
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849993193542814856 12/30/23-07:00:10.379084
SID:	2814856
Source Port:	49993
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849983193542814856 12/30/23-07:00:05.478752
SID:	2814856
Source Port:	49983
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849968193542033132 12/30/23-06:59:57.372313
SID:	2033132
Source Port:	49968
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749941193542033132 12/30/23-06:59:43.498607
SID:	2033132
Source Port:	49941
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949765193542033132 12/30/23-06:58:01.233628
SID:	2033132
Source Port:	49765
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749920193542033132 12/30/23-06:59:33.270015
SID:	2033132
Source Port:	49920
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749924193542033132 12/30/23-06:59:35.208692
SID:	2033132
Source Port:	49924
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749903193542033132 12/30/23-06:59:24.070627
SID:	2033132
Source Port:	49903
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749919193542814856 12/30/23-06:59:33.018377
SID:	2814856
Source Port:	49919
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749945193542033132 12/30/23-06:59:46.067668
SID:	2033132
Source Port:	49945
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849989193542033132 12/30/23-07:00:08.205585
SID:	2033132
Source Port:	49989
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949814193542814856 12/30/23-06:58:37.887301
SID:	2814856
Source Port:	49814
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949835193542814856 12/30/23-06:58:48.686724
SID:	2814856
Source Port:	49835
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749932193542814856 12/30/23-06:59:39.358213
SID:	2814856
Source Port:	49932
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949769193542033132 12/30/23-06:58:05.988000
SID:	2033132
Source Port:	49769
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749911193542814856 12/30/23-06:59:29.126763
SID:	2814856
Source Port:	49911
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749915193542814856 12/30/23-06:59:31.070055
SID:	2814856
Source Port:	49915
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749849193542033132 12/30/23-06:58:56.346466
SID:	2033132
Source Port:	49849
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949818193542814856 12/30/23-06:58:39.988518
SID:	2814856
Source Port:	49818
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949839193542814856 12/30/23-06:58:50.694196
SID:	2814856
Source Port:	49839
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749936193542814856 12/30/23-06:59:41.281512
SID:	2814856
Source Port:	49936
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749962193542033132 12/30/23-06:59:54.301440
SID:	2033132
Source Port:	49962
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749957193542814856 12/30/23-06:59:52.099962
SID:	2814856
Source Port:	49957
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1849985193542033132 12/30/23-07:00:06.216832
SID:	2033132
Source Port:	49985
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949802193542033132 12/30/23-06:58:30.906256
SID:	2033132
Source Port:	49802
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949823193542033132 12/30/23-06:58:42.341539
SID:	2033132
Source Port:	49823
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749862193542033132 12/30/23-06:59:02.844678
SID:	2033132
Source Port:	49862
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749883193542033132 12/30/23-06:59:14.334660
SID:	2033132
Source Port:	49883
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850051193542033132 12/30/23-07:00:39.525800
SID:	2033132
Source Port:	50051
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949844193542033132 12/30/23-06:58:53.721212
SID:	2033132
Source Port:	49844
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749749193542033132 12/30/23-06:57:32.111036
SID:	2033132
Source Port:	49749
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949827193542033132 12/30/23-06:58:44.367837
SID:	2033132
Source Port:	49827
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749866193542033132 12/30/23-06:59:04.846811
SID:	2033132
Source Port:	49866
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749887193542033132 12/30/23-06:59:16.275491
SID:	2033132
Source Port:	49887
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949780193542814856 12/30/23-06:58:17.081603
SID:	2814856
Source Port:	49780
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850004193542814856 12/30/23-07:00:15.787254
SID:	2814856
Source Port:	50004
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749953193542814856 12/30/23-06:59:50.142653
SID:	2814856
Source Port:	49953
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850046193542814856 12/30/23-07:00:36.764056
SID:	2814856
Source Port:	50046
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550065193542033132 12/30/23-07:00:46.284271
SID:	2033132
Source Port:	50065
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749895193542814856 12/30/23-06:59:20.392745
SID:	2814856
Source Port:	49895
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850025193542814856 12/30/23-07:00:26.469978
SID:	2814856
Source Port:	50025
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850030193542033132 12/30/23-07:00:28.712067
SID:	2033132
Source Port:	50030
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749745193542033132 12/30/23-06:57:21.641720
SID:	2033132
Source Port:	49745
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749853193542814856 12/30/23-06:58:58.560128
SID:	2814856
Source Port:	49853
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749874193542814856 12/30/23-06:59:09.083915
SID:	2814856
Source Port:	49874
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.156.13.209

Timestamp:	192.168.2.418.156.13.20949806193542033132 12/30/23-06:58:33.167163
SID:	2033132
Source Port:	49806
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749857193542814856 12/30/23-06:59:00.592542
SID:	2814856
Source Port:	49857
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749878193542814856 12/30/23-06:59:12.145204
SID:	2814856
Source Port:	49878
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850000193542814856 12/30/23-07:00:13.841135
SID:	2814856
Source Port:	50000
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850042193542814856 12/30/23-07:00:34.818033
SID:	2814856
Source Port:	50042
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 18.197.239.5

Timestamp:	192.168.2.418.197.239.550069193542033132 12/30/23-07:00:48.227392
SID:	2033132
Source Port:	50069
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.127.138.57

Timestamp:	192.168.2.43.127.138.5749899193542814856 12/30/23-06:59:22.330011
SID:	2814856
Source Port:	49899
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.4 - Destination IP: 3.126.37.18

Timestamp:	192.168.2.43.126.37.1850021193542814856 12/30/23-07:00:24.486098
SID:	2814856
Source Port:	50021
Destination Port:	19354
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: tiodtk2cfy.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Umbrella.flv.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\winhost.exe	Avira: detection malicious, Label: TR/Dropper.Gen
Source: C:\Users\user\AppData\Roaming\server.exe	Avira: detection malicious, Label: TR/Dropper.Gen

Found malware configuration

Source: 0.0.tiodtk2cfy.exe.470000.0.unpack

Malware Configuration Extractor: Njrat {"Campaign ID": "VicTim", "Version": "0.7d", "Install Name": "a1d56127836419435d08d7cc0808a629", "Install Dir": "system", "Registry Value": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Network Seprator": "|'|'|"}

Multi AV Scanner detection for domain / URL

Source: 2.tcp.eu.ngrok.io

Virustotal: Detection: 12%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Umbrella.flv.exe	ReversingLabs: Detection: 83%
Source: C:\Umbrella.flv.exe	Virustotal: Detection: 81%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Virustotal: Detection: 81%	Perma Link
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	Virustotal: Detection: 81%	Perma Link
Source: C:\Users\user\AppData\Roaming\server.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\server.exe	Virustotal: Detection: 81%	Perma Link
Source: C:\winhost.exe	ReversingLabs: Detection: 83%
Source: C:\winhost.exe	Virustotal: Detection: 81%	Perma Link

Multi AV Scanner detection for submitted file

Source: tiodtk2cfy.exe	ReversingLabs: Detection: 83%
Source: tiodtk2cfy.exe	Virustotal: Detection: 81%			Perma Link

Yara detected Njrat

Source: Yara match	File source: tiodtk2cfy.exe, type: SAMPLE
Source: Yara match	File source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4063644018.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tiodtk2cfy.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\winhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Joe Sandbox ML: detected
Source: C:\Umbrella.flv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	Joe Sandbox ML: detected
Source: C:\winhost.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\server.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: tiodtk2cfy.exe

Joe Sandbox ML: detected

Source: tiodtk2cfy.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: tiodtk2cfy.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Contains functionality to spread to USB devices (.Net source)

Source: tiodtk2cfy.exe, Usb1.cs	.Net Code: infect
Source: server.exe.0.dr, Usb1.cs	.Net Code: infect
Source: Microsoft Corporation.exe.1.dr, Usb1.cs	.Net Code: infect
Source: a1d56127836419435d08d7cc0808a629Windows Update.exe.1.dr, Usb1.cs	.Net Code: infect
Source: Umbrella.flv.exe.1.dr, Usb1.cs	.Net Code: infect
Source: winhost.exe.1.dr, Usb1.cs	.Net Code: infect

Creates autorun.inf (USB autostart)

Source: C:\Users\user\AppData\Roaming\server.exe

File created: C:\autorun.inf

Jump to behavior

Source: tiodtk2cfy.exe, 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: tiodtk2cfy.exe, 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: tiodtk2cfy.exe, 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: tiodtk2cfy.exe, 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: tiodtk2cfy.exe, 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: tiodtk2cfy.exe, 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: server.exe, 00000001.00000002.4063644018.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: server.exe, 00000001.00000002.4063644018.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: server.exe, 00000001.00000002.4063644018.00000000026E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf$OFk
Source: tiodtk2cfy.exe	Binary or memory string: \autorun.inf
Source: tiodtk2cfy.exe	Binary or memory string: [autorun]
Source: tiodtk2cfy.exe	Binary or memory string: autorun.inf
Source: autorun.inf.1.dr	Binary or memory string: [autorun]
Source: Microsoft Corporation.exe.1.dr	Binary or memory string: \autorun.inf
Source: Microsoft Corporation.exe.1.dr	Binary or memory string: [autorun]
Source: Microsoft Corporation.exe.1.dr	Binary or memory string: autorun.inf
Source: Umbrella.flv.exe.1.dr	Binary or memory string: \autorun.inf
Source: Umbrella.flv.exe.1.dr	Binary or memory string: [autorun]
Source: Umbrella.flv.exe.1.dr	Binary or memory string: autorun.inf
Source: a1d56127836419435d08d7cc0808a629Windows Update.exe.1.dr	Binary or memory string: \autorun.inf
Source: a1d56127836419435d08d7cc0808a629Windows Update.exe.1.dr	Binary or memory string: [autorun]
Source: a1d56127836419435d08d7cc0808a629Windows Update.exe.1.dr	Binary or memory string: autorun.inf
Source: winhost.exe.1.dr	Binary or memory string: \autorun.inf
Source: winhost.exe.1.dr	Binary or memory string: [autorun]
Source: winhost.exe.1.dr	Binary or memory string: autorun.inf
Source: server.exe.0.dr	Binary or memory string: \autorun.inf
Source: server.exe.0.dr	Binary or memory string: [autorun]
Source: server.exe.0.dr	Binary or memory string: autorun.inf

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49729 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49729 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49730 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49730 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49731 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49731 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49732 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49732 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49733 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49733 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49735 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49735 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49741 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49741 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49742 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49742 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49743 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49743 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49744 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49744 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49745 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49745 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49746 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49746 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49747 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49747 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.4:49747 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49747 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49748 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49748 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49749 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49749 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49750 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49750 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49751 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49751 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49752 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49752 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49753 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49753 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49754 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49754 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49755 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49755 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49756 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49756 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49757 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49757 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49759 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49759 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49760 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49760 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49761 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49761 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49762 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49762 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49763 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49763 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49764 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49764 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49765 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49765 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49766 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49766 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49767 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49767 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49768 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49768 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49769 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49769 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49770 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49770 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49771 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49771 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49772 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49772 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49773 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49773 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49774 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49774 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49775 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49775 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49776 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49776 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49777 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49777 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49778 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49778 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49779 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49779 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49780 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49780 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49781 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49781 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49782 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49782 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49783 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49783 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49784 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49784 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49785 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49785 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49786 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49786 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49787 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49787 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49788 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49788 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49789 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49789 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49790 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49790 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49791 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49791 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49792 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49792 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49793 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49793 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49794 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49794 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49795 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49795 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49796 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49796 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49797 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49797 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49798 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49798 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49799 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49799 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49800 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49800 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49801 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49801 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49802 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49802 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49803 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49803 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49804 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49804 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49805 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49805 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49806 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49806 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49807 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49808 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49808 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49809 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49809 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49810 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49810 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49811 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49811 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49812 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49812 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49813 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49813 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49814 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49814 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49815 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49815 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49816 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49816 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49817 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49817 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49818 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49818 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49819 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49819 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49820 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49820 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49821 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49821 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49822 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49822 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49823 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49823 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49824 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49824 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49825 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49825 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49826 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49826 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49827 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49827 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49828 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49828 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49829 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49829 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49830 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49830 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49831 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49831 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49832 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49832 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49833 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49833 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49834 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49834 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49835 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49835 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49836 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49836 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49837 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49837 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49838 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49838 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49839 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49839 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49840 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49840 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49841 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49842 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49843 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49843 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49844 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49844 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49845 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49845 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49846 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49846 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49847 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49847 -> 18.156.13.209:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49848 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49848 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49849 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49849 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49850 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49850 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49851 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49851 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49852 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49852 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49853 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49853 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49854 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49854 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49855 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49855 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49856 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49856 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49857 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49857 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49858 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49858 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49859 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49859 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49860 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49860 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49861 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49861 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49862 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49862 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49863 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49863 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49864 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49864 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49865 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49865 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49866 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49866 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49867 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49867 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49868 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49868 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49869 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49869 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49870 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49870 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49871 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49871 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49872 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49872 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49873 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49873 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49874 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49874 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49875 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49875 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49876 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49877 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49877 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49878 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49878 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49879 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49879 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49880 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49880 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49881 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49881 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49882 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49882 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49883 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49883 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49884 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49884 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49885 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49885 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49886 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49886 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49887 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49887 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49888 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49888 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49889 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49889 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49890 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49890 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49891 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49891 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49892 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49892 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49893 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49893 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49894 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49894 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49895 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49895 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49896 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49896 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49897 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49897 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49898 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49898 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49899 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49899 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49900 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49900 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49901 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49901 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49902 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49902 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49903 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49903 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49904 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49904 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49905 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49905 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49906 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49906 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49907 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49907 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49908 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49908 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49909 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49909 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49910 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49910 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49911 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49911 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49912 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49912 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49913 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49913 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49914 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49914 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49915 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49915 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49916 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49916 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49917 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49917 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49918 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49918 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49919 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49919 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49920 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49920 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49921 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49921 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49922 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49922 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49923 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49923 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49924 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49924 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49925 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49925 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49926 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49926 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49927 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49927 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49928 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49928 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49929 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49929 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49930 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49930 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49931 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49931 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49932 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49932 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49933 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49933 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49934 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49934 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49935 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49935 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49936 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49936 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49937 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49937 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49938 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49938 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49939 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49939 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49940 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49940 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49941 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49941 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49942 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49942 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49943 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49943 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49944 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49944 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49945 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49945 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49946 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49946 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49947 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49947 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49948 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49948 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49949 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49949 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49950 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49950 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49951 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49951 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49952 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49952 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49953 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49953 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49954 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49954 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49955 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49955 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49956 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49956 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49957 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49957 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49958 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49958 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49959 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49959 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49960 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49960 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49961 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49961 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49962 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49962 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49963 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49963 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49964 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49964 -> 3.127.138.57:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49965 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49965 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49966 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49966 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49967 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49967 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49968 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49968 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49969 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49969 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49970 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49970 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49971 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49971 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49972 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49972 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49973 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49973 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49974 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49974 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49975 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49975 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49976 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49976 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49977 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49977 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49978 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49978 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49979 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49979 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49980 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49980 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49981 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49981 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49982 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49982 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49983 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49983 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49984 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49984 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49985 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49985 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49986 -> 3.126.37.18:19354
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.4:49986 -> 3.126.37.18:19354

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 3.127.138.57 ports 19354,1,3,4,5,9
Source: global traffic	TCP traffic: 18.156.13.209 ports 19354,1,3,4,5,9
Source: global traffic	TCP traffic: 3.126.37.18 ports 19354,1,3,4,5,9
Source: global traffic	TCP traffic: 18.197.239.5 ports 19354,1,3,4,5,9

Source: global traffic	TCP traffic: 192.168.2.4:49729 -> 3.127.138.57:19354
Source: global traffic	TCP traffic: 192.168.2.4:49762 -> 18.156.13.209:19354
Source: global traffic	TCP traffic: 192.168.2.4:49965 -> 3.126.37.18:19354
Source: global traffic	TCP traffic: 192.168.2.4:50060 -> 18.197.239.5:19354

Source: Joe Sandbox View	IP Address: 3.127.138.57 3.127.138.57
Source: Joe Sandbox View	IP Address: 18.156.13.209 18.156.13.209

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 2.tcp.eu.ngrok.io

Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: tiodtk2cfy.exe, type: SAMPLE
Source: Yara match	File source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4063644018.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tiodtk2cfy.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\winhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: tiodtk2cfy.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: tiodtk2cfy.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: tiodtk2cfy.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: tiodtk2cfy.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\winhost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\winhost.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\winhost.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\winhost.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\AppData\Roaming\server.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_05090706 NtQuerySystemInformation,		1_2_05090706
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_050906D5 NtQuerySystemInformation,		1_2_050906D5

Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_00A52BDB	0_2_00A52BDB
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C44298	0_2_04C44298
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C44544	0_2_04C44544
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C447D4	0_2_04C447D4
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C4505D	0_2_04C4505D
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C44B5B	0_2_04C44B5B
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C450E3	0_2_04C450E3
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C4536F	0_2_04C4536F
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C44269	0_2_04C44269
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C444F1	0_2_04C444F1
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C449F9	0_2_04C449F9
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C45000	0_2_04C45000
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C4470F	0_2_04C4470F
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C44C8F	0_2_04C44C8F
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C44F9D	0_2_04C44F9D
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C4499D	0_2_04C4499D
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C44F2F	0_2_04C44F2F
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C44936	0_2_04C44936
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C44630	0_2_04C44630
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Code function: 0_2_04C45459	0_2_04C45459
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_00942DB6	1_2_00942DB6
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04844298	1_2_04844298
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_048475A8	1_2_048475A8
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_0484758E	1_2_0484758E
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_0484499D	1_2_0484499D
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_048447D4	1_2_048447D4
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_048444F1	1_2_048444F1
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_048449F9	1_2_048449F9
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_0484470F	1_2_0484470F
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04844936	1_2_04844936
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04844630	1_2_04844630
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04844544	1_2_04844544
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04844B5B	1_2_04844B5B
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04844269	1_2_04844269
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04844C8F	1_2_04844C8F
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04844F9D	1_2_04844F9D
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_048450E3	1_2_048450E3
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04845000	1_2_04845000
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04844F2F	1_2_04844F2F
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_0484505D	1_2_0484505D
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_04845459	1_2_04845459
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_0484536F	1_2_0484536F

Source: tiodtk2cfy.exe, 00000000.00000002.1629752992.0000000000A8E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs tiodtk2cfy.exe

Source: tiodtk2cfy.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: tiodtk2cfy.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: tiodtk2cfy.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: tiodtk2cfy.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: tiodtk2cfy.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\winhost.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\winhost.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\winhost.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\winhost.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.phis.troj.adwa.evad.winEXE@7/10@5/4

Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_0509058A AdjustTokenPrivileges,		1_2_0509058A
Source: C:\Users\user\AppData\Roaming\server.exe	Code function: 1_2_05090553 AdjustTokenPrivileges,		1_2_05090553

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

File created: C:\Users\user\AppData\Roaming\app

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Users\user\AppData\Roaming\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\a1d56127836419435d08d7cc0808a629
Source: C:\Users\user\AppData\Roaming\server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Jump to behavior

Source: tiodtk2cfy.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: tiodtk2cfy.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\276d7f4a20a3c21c3bf6fc9bfc1915a2\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tiodtk2cfy.exe	ReversingLabs: Detection: 83%
Source: tiodtk2cfy.exe	Virustotal: Detection: 81%

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

File read: C:\Users\user\Desktop\tiodtk2cfy.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\tiodtk2cfy.exe C:\Users\user\Desktop\tiodtk2cfy.exe
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process created: C:\Users\user\AppData\Roaming\server.exe "C:\Users\user\AppData\Roaming\server.exe"
Source: C:\Users\user\AppData\Roaming\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process created: C:\Users\user\AppData\Roaming\server.exe "C:\Users\user\AppData\Roaming\server.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE	Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: tiodtk2cfy.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: tiodtk2cfy.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: tiodtk2cfy.exe, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: server.exe.0.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Microsoft Corporation.exe.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: a1d56127836419435d08d7cc0808a629Windows Update.exe.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Umbrella.flv.exe.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: winhost.exe.1.dr, Fransesco.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Roaming\server.exe

Code function: 1_2_00AF1060 pushfd ; retf 0000h

1_2_00AF1065

Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Jump to dropped file
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	File created: C:\Users\user\AppData\Roaming\server.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\winhost.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Umbrella.flv.exe	Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe			Jump to dropped file
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\server.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe			Jump to behavior

Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe	Window / User API: threadDelayed 1995	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Window / User API: threadDelayed 2639	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Window / User API: foregroundWindowGot 682	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Window / User API: foregroundWindowGot 704	Jump to behavior

Source: C:\Users\user\Desktop\tiodtk2cfy.exe TID: 7528	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe TID: 7716	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe TID: 7596	Thread sleep time: -1995000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe TID: 7596	Thread sleep time: -2639000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe TID: 8056	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\tiodtk2cfy.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\server.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: server.exe, 00000001.00000002.4063080190.0000000000769000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdlImporters>
Source: netsh.exe, 00000002.00000002.1646926055.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: tiodtk2cfy.exe, 00000000.00000002.1629752992.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: server.exe, 00000001.00000002.4063080190.0000000000769000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllss#SuspenderProcesss!RestarttProcesss!PermisaoStartUpp%ChamaFrmStartUpsss#EnviarStartupsssa]Software\Microsoft\Windows\CurrentVersion\Run\
Source: tiodtk2cfy.exe, 00000000.00000002.1629752992.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\=

Source: C:\Users\user\AppData\Roaming\server.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\tiodtk2cfy.exe

Process created: C:\Users\user\AppData\Roaming\server.exe "C:\Users\user\AppData\Roaming\server.exe"

Jump to behavior

Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 20:58:58 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:52:38 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 08:31:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 09:46:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:17:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:54:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 02:45:14 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:54:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:41:05 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:26:48 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 23:36:23 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:36:07 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:01:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:05:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 21:09:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 21:40:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:12:20 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 14:00:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 18:15:24 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:39:44 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 17:52:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 17:46:06 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 07:39:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 10:04:49 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 23:56:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 21:04:20 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 01:16:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 09:40:19 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 04:44:14 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 19:00:48 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:02:15 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:12:16 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 18:02:03 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 13:22:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 14:29:33 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 09:38:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 17:53:56 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:42:03 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:15:07 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 06:50:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 17:01:38 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/03 \| 01:02:01 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:24:40 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:04:03 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:30:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 04:10:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:13:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 21:25:44 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:32:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:44:53 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 06:53:09 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 08:53:39 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:59:29 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 13:17:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:22:58 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:36:59 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 10:30:15 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:20:05 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 06:45:34 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:18:53 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:29:36 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 04:53:47 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:15:59 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:53:48 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:26:57 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 07:08:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:28:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 10:23:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 09:45:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:58:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 14:33:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:05:28 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:43:32 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 22:17:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:53:38 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:45:43 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 01:27:51 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:38:32 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:58:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:13:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 04:49:20 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:01:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 02:18:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:53:44 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:50:39 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 10:45:20 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 09:24:01 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 18:48:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:09:16 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:14:09 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 20:15:19 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 08:52:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 17:17:05 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 18:38:58 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 08:31:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:48:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:40:24 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 09:51:08 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:34:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 04:42:58 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:37:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:21:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 04:52:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:59:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:19:08 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 06:40:28 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 06:18:38 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 10:29:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 20:59:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 19:48:28 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:41:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/03 \| 00:47:34 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 13:49:26 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:37:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 10:20:19 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 12:36:53 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:14:58 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:28:27 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:23:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:07:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 06:05:57 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:12:03 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:24:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 11:13:07 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:44:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:55:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 08:58:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 17:09:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:06:34 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:48:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:13:08 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:15:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 04:17:46 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 04:01:40 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:38:15 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:07:32 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:50:20 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 11:56:46 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 08:26:32 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 13:10:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:18:47 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 09:30:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/03 \| 01:00:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 18:46:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:23:39 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 19:17:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 14:27:49 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 06:33:15 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 07:17:09 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 22:37:24 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:11:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:56:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 19:33:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:28:26 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 21:45:38 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 22:21:57 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 12:50:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:51:22 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 12:03:10 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:28:06 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 17:32:58 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:04:51 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:51:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:16:33 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:49:36 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 11:37:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 10:31:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:09:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 04:51:24 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:08:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 02:52:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:59:15 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 22:28:58 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:28:41 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 08:39:16 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:05:39 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002A33000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 23:51:39 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 01:27:51 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:19:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:38:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 04:53:47 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:36:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:40:52 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:21:26 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 14:31:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 12:43:26 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:59:49 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:24:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:43:40 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:28:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 10:40:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 21:03:29 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:50:01 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 18:46:44 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:25:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 11:35:22 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:43:59 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:31:04 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:23:49 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 08:06:10 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:53:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:21:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:08:15 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:41:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 20:33:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:33:27 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:07:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 09:49:49 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 19:53:46 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 08:23:10 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 12:04:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 06:49:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:38:09 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:19:51 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:02:41 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 10:36:23 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:54:07 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:46:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 01:53:56 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:33:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:05:44 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 08:16:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 07:22:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:30:41 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:57:44 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:12:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:08:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:54:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 04:06:57 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 08:59:38 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 13:12:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:29:10 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:47:34 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/03 \| 00:12:07 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 08:40:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:27:16 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 17:10:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 08:19:22 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:00:57 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 18:47:24 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:39:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:53:39 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 02:34:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 08:54:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 06:13:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:27:06 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 00:10:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:21:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 13:28:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:55:09 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:00:57 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 14:01:47 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 02:37:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:46:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 17:52:26 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 02:03:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 07:35:39 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:09:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:34:01 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 06:51:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:23:48 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/03 \| 01:03:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:46:23 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:38:51 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:24:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 01:03:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 18:52:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:11:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:33:59 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 20:14:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:35:14 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:27:29 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:55:32 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 11:28:40 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 09:29:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:43:41 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:12:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:29:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:17:47 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 10:03:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 17:04:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:51:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:51:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:01:56 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:02:10 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 21:19:33 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:28:43 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:49:41 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 07:13:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:59:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 17:51:24 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 18:53:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:02:27 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 13:00:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:58:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 18:49:29 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 14:27:10 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:59:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:23:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 01:41:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:13:41 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 06:14:23 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 12:54:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:40:33 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:33:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:21:58 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 17:10:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 02:51:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 04:39:33 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:26:24 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 20:37:25 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:25:33 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:04:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 08:14:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 17:00:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 01:46:15 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 11:00:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:04:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:41:36 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:29:48 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 12:32:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:14:49 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 10:42:06 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:10:14 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:35:43 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 17:17:46 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:12:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:08:19 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:47:57 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:20:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:40:28 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:06:39 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:36:01 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:15:14 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:42:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 12:48:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 17:43:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 06:43:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 07:41:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 05:52:09 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 06:49:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 00:18:19 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 01:55:40 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:24:05 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:27:34 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 13:04:01 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 05:44:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:54:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 01:24:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 09:06:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 08:38:14 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 04:08:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 19:37:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:37:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 09:07:01 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 07:27:05 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 12:38:00 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:04:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 02:31:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 13:26:10 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 18:04:26 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:44:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 17:29:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:53:29 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 18:58:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 01:08:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 07:16:16 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 09:38:43 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:17:28 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 08:19:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:47:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 16:58:05 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 06:59:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 08:21:17 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 07:05:49 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:38:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:40:05 - Program Manager
Source: tiodtk2cfy.exe, Microsoft Corporation.exe.1.dr, Umbrella.flv.exe.1.dr, a1d56127836419435d08d7cc0808a629Windows Update.exe.1.dr, winhost.exe.1.dr, server.exe.0.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:41:08 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:26:03 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 09:08:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 12:02:56 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 18:05:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 04:29:28 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 05:32:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:03:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 00:34:26 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 02:10:46 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:30:53 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 08:14:50 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:51:01 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:16:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:14:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 18:33:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:18:52 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:24:49 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:33:22 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 18:58:54 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 17:26:47 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:59:47 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:42:06 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:02:23 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 04:16:53 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 13:05:03 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 11:13:44 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:15:44 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:25:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:58:02 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:40:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:13:56 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 08:54:21 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:17:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:34:23 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 19:58:05 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 23/12/30 \| 06:57:17 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 18:41:29 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 13:43:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 05:01:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 21:55:34 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:12:08 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:52:58 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:39:43 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 05:02:40 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 08:41:57 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 00:51:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:03:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 09:36:59 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:13:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:30:53 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:57:48 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 17:54:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 17:32:23 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 09:18:38 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:40:32 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:54:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:19:16 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:52:46 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 11:48:34 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:57:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:48:14 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 18:27:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 05:43:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:23:47 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 00:57:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:16:23 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 15:00:46 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 05:49:12 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 14:10:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:23:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 22:23:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 09:23:02 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 20:13:55 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 22:07:34 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 21:10:39 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 12:59:30 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 12:24:25 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:29:47 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 10:34:22 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 02:00:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 23:16:27 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 17:23:07 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 13:14:08 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 04:55:40 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:19:36 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 11:02:49 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 21:22:39 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:03:03 - Program Manager
Source: server.exe, 00000001.00000002.4063644018.0000000002AEE000.00000004.00000800.00020000.00000000.sdmp, server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 08:15:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 17:05:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 22:32:42 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 06:35:38 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 04:23:35 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 17:41:37 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 07:11:29 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 01:47:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 10:23:05 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 00:29:45 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:26:36 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 20:25:24 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:18:15 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:36:18 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/05 \| 10:30:46 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 14:51:14 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 16:08:47 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 22:27:28 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 12:01:26 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:26:33 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/07 \| 19:26:05 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 10:51:31 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 11:23:34 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 12:41:03 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/12 \| 18:52:24 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 12:14:07 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 09:11:59 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:10:53 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 00:50:11 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/13 \| 03:59:26 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 03:02:04 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/10 \| 04:45:13 - Program Manager
Source: server.exe, 00000001.00000002.4064874288.00000000038F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/01/02 \| 13:28:33 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Contains functionality to disable the Task Manager (.Net Source)

Source: tiodtk2cfy.exe, Fransesco.cs	.Net Code: INS
Source: server.exe.0.dr, Fransesco.cs	.Net Code: INS
Source: Microsoft Corporation.exe.1.dr, Fransesco.cs	.Net Code: INS
Source: a1d56127836419435d08d7cc0808a629Windows Update.exe.1.dr, Fransesco.cs	.Net Code: INS
Source: Umbrella.flv.exe.1.dr, Fransesco.cs	.Net Code: INS
Source: winhost.exe.1.dr, Fransesco.cs	.Net Code: INS

Disables zone checking for all users

Source: C:\Users\user\AppData\Roaming\server.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\AppData\Roaming\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\AppData\Roaming\server.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: tiodtk2cfy.exe, type: SAMPLE
Source: Yara match	File source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4063644018.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tiodtk2cfy.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\winhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: tiodtk2cfy.exe, type: SAMPLE
Source: Yara match	File source: 0.0.tiodtk2cfy.exe.470000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4063644018.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: tiodtk2cfy.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: server.exe PID: 7592, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, type: DROPPED
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED
Source: Yara match	File source: C:\winhost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\server.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
21 Replication Through Removable Media	Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	21 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Process Injection	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	Exfiltration Over Bluetooth	1 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	12 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
tiodtk2cfy.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
tiodtk2cfy.exe	82%	Virustotal		Browse
tiodtk2cfy.exe	100%	Avira	TR/Dropper.Gen
tiodtk2cfy.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Avira	TR/Dropper.Gen
C:\Umbrella.flv.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	100%	Avira	TR/Dropper.Gen
C:\winhost.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\server.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	100%	Joe Sandbox ML
C:\Umbrella.flv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	100%	Joe Sandbox ML
C:\winhost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\server.exe	100%	Joe Sandbox ML
C:\Umbrella.flv.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Umbrella.flv.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe	82%	Virustotal		Browse
C:\Users\user\AppData\Roaming\server.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Roaming\server.exe	82%	Virustotal		Browse
C:\winhost.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\winhost.exe	82%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
2.tcp.eu.ngrok.io	12%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
2.tcp.eu.ngrok.io	3.127.138.57	true	true	12%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.127.138.57	2.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
18.156.13.209	unknown	United States	16509	AMAZON-02US	true
3.126.37.18	unknown	United States	16509	AMAZON-02US	true
18.197.239.5	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1368193
Start date and time:	2023-12-30 06:56:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	tiodtk2cfy.exe renamed because original name is a hash value
Original Sample Name:	b56be916b1ca250cd9fe04b283e0c3ee.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.adwa.evad.winEXE@7/10@5/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 100 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:56:55	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe
05:57:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
06:57:26	API Interceptor	829850x Sleep call for process: server.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.127.138.57	QUuUm3J8x3.exe	Get hash	malicious	Njrat	Browse
	RWqHoCWEPI.exe	Get hash	malicious	Njrat	Browse
	OUXkIxeP6k.exe	Get hash	malicious	Njrat	Browse
	eI43OwXSvq.exe	Get hash	malicious	Njrat	Browse
	i9z1c1OtFb.exe	Get hash	malicious	Njrat	Browse
	JYGc3o49WE.exe	Get hash	malicious	Njrat	Browse
	J6VIiRgq3w.exe	Get hash	malicious	Njrat	Browse
	7JdbeSrZ6s.exe	Get hash	malicious	Njrat	Browse
	KcWQQO3nZP.exe	Get hash	malicious	Njrat	Browse
	zep8vTa4sg.exe	Get hash	malicious	Njrat	Browse
	umyExrpkSF.exe	Get hash	malicious	Njrat	Browse
	QBEgLAO40T.exe	Get hash	malicious	Njrat	Browse
	4KWKhZNy9w.exe	Get hash	malicious	Njrat	Browse
	yPGBUzqVE3.exe	Get hash	malicious	Njrat	Browse
	D02E3399D85D6B14B30F440181EF5B8FE6B55C403B8C7.exe	Get hash	malicious	njRat	Browse
	2dZGR4PTLu.exe	Get hash	malicious	Njrat	Browse
	LMva1J8Xkv.exe	Get hash	malicious	Njrat	Browse
	XlNjZS4E8x.exe	Get hash	malicious	Njrat	Browse
	1F3YBPagot.exe	Get hash	malicious	Nanocore	Browse
	H7mLbVb7Tm.exe	Get hash	malicious	Njrat	Browse
18.156.13.209	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.tcp.eu.ngrok.io	QUuUm3J8x3.exe	Get hash	malicious	Njrat	Browse	3.127.138.57
	81Rz15POL6.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	649DB66A36E095B16832637A31D3CCC75040C5A6C23F6.exe	Get hash	malicious	Njrat	Browse	18.156.13.209
	pQBmVoyRnw.exe	Get hash	malicious	Njrat	Browse	18.156.13.209
	RWqHoCWEPI.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	EB4B6878310B1E2843C964E02EC1782AACB518E32777A.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	NezbdhNgwG.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	xdPdkPMD8u.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	VBUXm77rfL.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	1UGdjTlX5v.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	kXghM8bJcm.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	OUXkIxeP6k.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	QzzmZiGinp.exe	Get hash	malicious	Njrat	Browse	18.156.13.209
	eI43OwXSvq.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	p0zYXkMETE.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	i9z1c1OtFb.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	aF73k2XwGj.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	7XyFhq6BDj.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	JYGc3o49WE.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	J6VIiRgq3w.exe	Get hash	malicious	Njrat	Browse	3.126.37.18

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	sg4Mw15RpV.exe	Get hash	malicious	Njrat	Browse	3.67.161.133
	https://www.americanexpressseguros.com/	Get hash	malicious	Unknown	Browse	13.225.47.89
	https://www.direct.smbc.shengmabxg.com/ibg/client/home.php	Get hash	malicious	Unknown	Browse	54.150.240.172
	https://www.smbc.link.lekeogroup.com/	Get hash	malicious	Unknown	Browse	13.113.75.209
	https://www.pay.screnlefu.com/ibg/client/home.php	Get hash	malicious	Unknown	Browse	13.113.75.209
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//haulitalldmv.com/fixeddoc/mainline/adbdoc/gjhfkghfgfghfhjfghfjghjfghfhgfhghfjhdfjhjdfdf/fjghfjhguhurhgjghjfgjdhjdhghfghkfgjkdghjgljklhjkykutukhkfhgjfghdhghdgfhgegdghjdfghjhgjdgh/iiojbtvqupszfgguzwpwymkdccitcssrkvurbazqqostwbjutwgnijdiregmzhvwdwemqwhluxzlckcmtuaruhbdntcimlqxwfmn/bWF0dGhldy5tY2RvbmFsZEBkb3QuZ292	Get hash	malicious	Unknown	Browse	13.225.47.24
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	104.192.141.1
	https://vqrvoca8x6h374fj71x.blob.core.windows.net/vqrvoca8x6h374fj71x/url.html#cl/7671_md/12/613/2075/415/1157811	Get hash	malicious	Phisher	Browse	18.245.113.73
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	52.217.200.137
	SqhpdzwbpB.exe	Get hash	malicious	Gurcu Stealer	Browse	18.218.18.183
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	DG8gGqfke1.exe	Get hash	malicious	Unknown	Browse	18.154.242.89
	https://www.msn.com/fr-fr	Get hash	malicious	Unknown	Browse	44.225.83.80
	https://pub-5e1216f7ac0c4c66ad3357156574b076.r2.dev/American_Express_card_protection.htm	Get hash	malicious	HTMLPhisher	Browse	35.166.198.201
	https://pub-deefeb5d00534e3992bcd5b787c594a8.r2.dev/jsnew.html	Get hash	malicious	HTMLPhisher	Browse	18.245.113.72
	Patch_MB 4.6.x.exe	Get hash	malicious	Unknown	Browse	52.27.99.226
	https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793	Get hash	malicious	Unknown	Browse	35.161.163.45
	https://ipfs.io/ipfs/QmXTmcbaHxbnpYGmiteZq5F2DK46p6iMTdvnpd5iSnnYLo/index.html	Get hash	malicious	Unknown	Browse	65.8.228.116
	s8M01kYpwz.elf	Get hash	malicious	Mirai	Browse	13.208.205.138
	file.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	44.236.177.54
AMAZON-02US	sg4Mw15RpV.exe	Get hash	malicious	Njrat	Browse	3.67.161.133
	https://www.americanexpressseguros.com/	Get hash	malicious	Unknown	Browse	13.225.47.89
	https://www.direct.smbc.shengmabxg.com/ibg/client/home.php	Get hash	malicious	Unknown	Browse	54.150.240.172
	https://www.smbc.link.lekeogroup.com/	Get hash	malicious	Unknown	Browse	13.113.75.209
	https://www.pay.screnlefu.com/ibg/client/home.php	Get hash	malicious	Unknown	Browse	13.113.75.209
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//haulitalldmv.com/fixeddoc/mainline/adbdoc/gjhfkghfgfghfhjfghfjghjfghfhgfhghfjhdfjhjdfdf/fjghfjhguhurhgjghjfgjdhjdhghfghkfgjkdghjgljklhjkykutukhkfhgjfghdhghdgfhgegdghjdfghjhgjdgh/iiojbtvqupszfgguzwpwymkdccitcssrkvurbazqqostwbjutwgnijdiregmzhvwdwemqwhluxzlckcmtuaruhbdntcimlqxwfmn/bWF0dGhldy5tY2RvbmFsZEBkb3QuZ292	Get hash	malicious	Unknown	Browse	13.225.47.24
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	104.192.141.1
	https://vqrvoca8x6h374fj71x.blob.core.windows.net/vqrvoca8x6h374fj71x/url.html#cl/7671_md/12/613/2075/415/1157811	Get hash	malicious	Phisher	Browse	18.245.113.73
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	52.217.200.137
	SqhpdzwbpB.exe	Get hash	malicious	Gurcu Stealer	Browse	18.218.18.183
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	DG8gGqfke1.exe	Get hash	malicious	Unknown	Browse	18.154.242.89
	https://www.msn.com/fr-fr	Get hash	malicious	Unknown	Browse	44.225.83.80
	https://pub-5e1216f7ac0c4c66ad3357156574b076.r2.dev/American_Express_card_protection.htm	Get hash	malicious	HTMLPhisher	Browse	35.166.198.201
	https://pub-deefeb5d00534e3992bcd5b787c594a8.r2.dev/jsnew.html	Get hash	malicious	HTMLPhisher	Browse	18.245.113.72
	Patch_MB 4.6.x.exe	Get hash	malicious	Unknown	Browse	52.27.99.226
	https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793	Get hash	malicious	Unknown	Browse	35.161.163.45
	https://ipfs.io/ipfs/QmXTmcbaHxbnpYGmiteZq5F2DK46p6iMTdvnpd5iSnnYLo/index.html	Get hash	malicious	Unknown	Browse	65.8.228.116
	s8M01kYpwz.elf	Get hash	malicious	Mirai	Browse	13.208.205.138
	file.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	44.236.177.54
AMAZON-02US	sg4Mw15RpV.exe	Get hash	malicious	Njrat	Browse	3.67.161.133
	https://www.americanexpressseguros.com/	Get hash	malicious	Unknown	Browse	13.225.47.89
	https://www.direct.smbc.shengmabxg.com/ibg/client/home.php	Get hash	malicious	Unknown	Browse	54.150.240.172
	https://www.smbc.link.lekeogroup.com/	Get hash	malicious	Unknown	Browse	13.113.75.209
	https://www.pay.screnlefu.com/ibg/client/home.php	Get hash	malicious	Unknown	Browse	13.113.75.209
	https://p.feedblitz.com/t3.asp?/1081591/102442729/7821567_/~feeds.feedblitz.com/~/t/0/0/sethsblog/posts/~//haulitalldmv.com/fixeddoc/mainline/adbdoc/gjhfkghfgfghfhjfghfjghjfghfhgfhghfjhdfjhjdfdf/fjghfjhguhurhgjghjfgjdhjdhghfghkfgjkdghjgljklhjkykutukhkfhgjfghdhghdgfhgegdghjdfghjhgjdgh/iiojbtvqupszfgguzwpwymkdccitcssrkvurbazqqostwbjutwgnijdiregmzhvwdwemqwhluxzlckcmtuaruhbdntcimlqxwfmn/bWF0dGhldy5tY2RvbmFsZEBkb3QuZ292	Get hash	malicious	Unknown	Browse	13.225.47.24
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	104.192.141.1
	https://vqrvoca8x6h374fj71x.blob.core.windows.net/vqrvoca8x6h374fj71x/url.html#cl/7671_md/12/613/2075/415/1157811	Get hash	malicious	Phisher	Browse	18.245.113.73
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	52.217.200.137
	SqhpdzwbpB.exe	Get hash	malicious	Gurcu Stealer	Browse	18.218.18.183
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	DG8gGqfke1.exe	Get hash	malicious	Unknown	Browse	18.154.242.89
	https://www.msn.com/fr-fr	Get hash	malicious	Unknown	Browse	44.225.83.80
	https://pub-5e1216f7ac0c4c66ad3357156574b076.r2.dev/American_Express_card_protection.htm	Get hash	malicious	HTMLPhisher	Browse	35.166.198.201
	https://pub-deefeb5d00534e3992bcd5b787c594a8.r2.dev/jsnew.html	Get hash	malicious	HTMLPhisher	Browse	18.245.113.72
	Patch_MB 4.6.x.exe	Get hash	malicious	Unknown	Browse	52.27.99.226
	https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793	Get hash	malicious	Unknown	Browse	35.161.163.45
	https://ipfs.io/ipfs/QmXTmcbaHxbnpYGmiteZq5F2DK46p6iMTdvnpd5iSnnYLo/index.html	Get hash	malicious	Unknown	Browse	65.8.228.116
	s8M01kYpwz.elf	Get hash	malicious	Mirai	Browse	13.208.205.138
	file.exe	Get hash	malicious	Glupteba, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	44.236.177.54

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.564110245087195
Encrypted:	false
SSDEEP:	768:oY30wb30YTXspgM0m2zGjpyDtdXWuhtXYLWhyXxrjEtCdnl2pi1Rz4Rk3hsGdpP3:EwT0AA0mT1mrWxL5jEwzGi1dDxDPgS
MD5:	B56BE916B1CA250CD9FE04B283E0C3EE
SHA1:	8F10D4274FB142A1B296702D5A430E95D3225E9B
SHA-256:	A1586D89FCBDA8B94C59634A7D68BA4B6E884C68A92355C6487068D2212B6043
SHA-512:	9DCE2944F564342862816EE023E1BCF25705CBAF86F282B88FF7B2D76E4946B8531F42F467ED31B11A6F0FF44A81C2FB2AD66206A1178B6A3CF3266990AD0438
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Umbrella.flv.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Umbrella.flv.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Umbrella.flv.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Umbrella.flv.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...fQ.e.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Microsoft Corporation.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tiodtk2cfy.exe.log

Download File

Process:	C:\Users\user\Desktop\tiodtk2cfy.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.564110245087195
Encrypted:	false
SSDEEP:	768:oY30wb30YTXspgM0m2zGjpyDtdXWuhtXYLWhyXxrjEtCdnl2pi1Rz4Rk3hsGdpP3:EwT0AA0mT1mrWxL5jEwzGi1dDxDPgS
MD5:	B56BE916B1CA250CD9FE04B283E0C3EE
SHA1:	8F10D4274FB142A1B296702D5A430E95D3225E9B
SHA-256:	A1586D89FCBDA8B94C59634A7D68BA4B6E884C68A92355C6487068D2212B6043
SHA-512:	9DCE2944F564342862816EE023E1BCF25705CBAF86F282B88FF7B2D76E4946B8531F42F467ED31B11A6F0FF44A81C2FB2AD66206A1178B6A3CF3266990AD0438
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...fQ.e.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.564110245087195
Encrypted:	false
SSDEEP:	768:oY30wb30YTXspgM0m2zGjpyDtdXWuhtXYLWhyXxrjEtCdnl2pi1Rz4Rk3hsGdpP3:EwT0AA0mT1mrWxL5jEwzGi1dDxDPgS
MD5:	B56BE916B1CA250CD9FE04B283E0C3EE
SHA1:	8F10D4274FB142A1B296702D5A430E95D3225E9B
SHA-256:	A1586D89FCBDA8B94C59634A7D68BA4B6E884C68A92355C6487068D2212B6043
SHA-512:	9DCE2944F564342862816EE023E1BCF25705CBAF86F282B88FF7B2D76E4946B8531F42F467ED31B11A6F0FF44A81C2FB2AD66206A1178B6A3CF3266990AD0438
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...fQ.e.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Users\user\AppData\Roaming\app

Download File

Process:	C:\Users\user\Desktop\tiodtk2cfy.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Zn:Z
MD5:	B66E20886F9675FE4DBF430EA2D0BF8D
SHA1:	2E676DA72201E6E4482E00B300511900C6AEE5A0
SHA-256:	899A421C56C18058CBDD16DD7FB313A57D36C1189CA0F442070ED01D17241414
SHA-512:	F431616522F775DE27CCDE420F0DE6F8B3477FBE97CFD8001864B8289A570916A6DD32C84FCF8AF6083D8C1B47C61AA5C73ED1E7CC75213D3F24BD94A93CB870
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.30

C:\Users\user\AppData\Roaming\server.exe

Download File

Process:	C:\Users\user\Desktop\tiodtk2cfy.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.564110245087195
Encrypted:	false
SSDEEP:	768:oY30wb30YTXspgM0m2zGjpyDtdXWuhtXYLWhyXxrjEtCdnl2pi1Rz4Rk3hsGdpP3:EwT0AA0mT1mrWxL5jEwzGi1dDxDPgS
MD5:	B56BE916B1CA250CD9FE04B283E0C3EE
SHA1:	8F10D4274FB142A1B296702D5A430E95D3225E9B
SHA-256:	A1586D89FCBDA8B94C59634A7D68BA4B6E884C68A92355C6487068D2212B6043
SHA-512:	9DCE2944F564342862816EE023E1BCF25705CBAF86F282B88FF7B2D76E4946B8531F42F467ED31B11A6F0FF44A81C2FB2AD66206A1178B6A3CF3266990AD0438
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\server.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 82%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...fQ.e.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\autorun.inf

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	Microsoft Windows Autorun file
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.474554204780528
Encrypted:	false
SSDEEP:	3:It1KV2PHQCyK0x:e1KAwCyD
MD5:	40B1630BE21F39CB17BD1963CAE5A207
SHA1:	63C14BD151D42820DD45C033363FA5B9E1D34124
SHA-256:	F87E55F1A423B65FD639146F71F6027DBD4D6E69B65D9A17F1744774AA6589E1
SHA-512:	833112ED4A9A3C621D2FFFC78F83502B2937B82A2CF9BC692D75D907CE2AA46C2D97CFE23C402DB3292B2DD2655FF8692C3CD00D5BA4D792C3D8AF24958E1926
Malicious:	true
Preview:	[autorun]..open=C:\Umbrella.flv.exe..shellexecute=C:\..

C:\winhost.exe

Download File

Process:	C:\Users\user\AppData\Roaming\server.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	5.564110245087195
Encrypted:	false
SSDEEP:	768:oY30wb30YTXspgM0m2zGjpyDtdXWuhtXYLWhyXxrjEtCdnl2pi1Rz4Rk3hsGdpP3:EwT0AA0mT1mrWxL5jEwzGi1dDxDPgS
MD5:	B56BE916B1CA250CD9FE04B283E0C3EE
SHA1:	8F10D4274FB142A1B296702D5A430E95D3225E9B
SHA-256:	A1586D89FCBDA8B94C59634A7D68BA4B6E884C68A92355C6487068D2212B6043
SHA-512:	9DCE2944F564342862816EE023E1BCF25705CBAF86F282B88FF7B2D76E4946B8531F42F467ED31B11A6F0FF44A81C2FB2AD66206A1178B6A3CF3266990AD0438
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\winhost.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\winhost.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\winhost.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\winhost.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\winhost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84% Antivirus: Virustotal, Detection: 82%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...fQ.e.................p............... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text....o... ...p.................. ..`.reloc...............r..............@..B................................................................H.......................................................................&.(......*..(.......s.........s ........s!........s"..........0...........~....o#....+...0...........~....o$....+...0...........~....o%....+...0...........~....o&....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.564110245087195
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	tiodtk2cfy.exe
File size:	95'232 bytes
MD5:	b56be916b1ca250cd9fe04b283e0c3ee
SHA1:	8f10d4274fb142a1b296702d5a430e95d3225e9b
SHA256:	a1586d89fcbda8b94c59634a7d68ba4b6e884c68a92355c6487068d2212b6043
SHA512:	9dce2944f564342862816ee023e1bcf25705cbaf86f282b88ff7b2d76e4946b8531f42f467ed31b11a6f0ff44a81c2fb2ad66206a1178b6a3cf3266990ad0438
SSDEEP:	768:oY30wb30YTXspgM0m2zGjpyDtdXWuhtXYLWhyXxrjEtCdnl2pi1Rz4Rk3hsGdpP3:EwT0AA0mT1mrWxL5jEwzGi1dDxDPgS
TLSH:	1B93D88977E56524E4BF5AF75472F2004F74B54B1602E39D48F218AA0B33AC44F89FEA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...fQ.e.................p............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x418f0e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x658C5166 [Wed Dec 27 16:31:34 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x18ebc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16f14	0x17000	False	0.36806852921195654	data	5.5958167320938665	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.418.197.239.550070193542814856 12/30/23-07:00:48.954923	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50070	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550072193542814856 12/30/23-07:00:49.937293	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50072	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550071193542814856 12/30/23-07:00:49.443578	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50071	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550074193542814856 12/30/23-07:00:50.928621	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50074	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949844193542814856 12/30/23-06:58:53.964218	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49844	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949845193542814856 12/30/23-06:58:54.461893	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49845	19354	192.168.2.4	18.156.13.209
192.168.2.418.197.239.550073193542814856 12/30/23-07:00:50.430940	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50073	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949846193542814856 12/30/23-06:58:54.962969	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49846	19354	192.168.2.4	18.156.13.209
192.168.2.418.197.239.550078193542814856 12/30/23-07:00:52.921914	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50078	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949847193542814856 12/30/23-06:58:55.462477	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49847	19354	192.168.2.4	18.156.13.209
192.168.2.418.197.239.550075193542814856 12/30/23-07:00:51.423156	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50075	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550079193542814856 12/30/23-07:00:53.417118	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50079	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550076193542814856 12/30/23-07:00:51.914234	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50076	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550077193542814856 12/30/23-07:00:52.429766	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50077	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949843193542814856 12/30/23-06:58:53.458642	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49843	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949832193542814856 12/30/23-06:58:47.148856	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49832	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949831193542814856 12/30/23-06:58:46.651530	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49831	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949840193542814856 12/30/23-06:58:51.198140	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49840	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949830193542814856 12/30/23-06:58:46.139598	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49830	19354	192.168.2.4	18.156.13.209
192.168.2.418.197.239.550080193542814856 12/30/23-07:00:53.911195	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50080	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949763193542033132 12/30/23-06:57:58.658795	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49763	19354	192.168.2.4	18.156.13.209
192.168.2.418.197.239.550060193542814856 12/30/23-07:00:44.073546	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50060	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550061193542814856 12/30/23-07:00:44.563845	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50061	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550081193542814856 12/30/23-07:00:54.395316	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50081	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949762193542033132 12/30/23-06:57:56.539963	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49762	19354	192.168.2.4	18.156.13.209
192.168.2.418.197.239.550082193542814856 12/30/23-07:00:58.229074	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50082	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550064193542814856 12/30/23-07:00:46.036167	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50064	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550063193542814856 12/30/23-07:00:45.540599	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50063	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550062193542814856 12/30/23-07:00:45.053977	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50062	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550068193542814856 12/30/23-07:00:47.982577	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50068	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550067193542814856 12/30/23-07:00:47.495787	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50067	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550069193542814856 12/30/23-07:00:48.469821	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50069	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550065193542814856 12/30/23-07:00:46.523306	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50065	19354	192.168.2.4	18.197.239.5
192.168.2.418.197.239.550066193542814856 12/30/23-07:00:47.015523	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50066	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949773193542033132 12/30/23-06:58:10.061344	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49773	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749910193542033132 12/30/23-06:59:28.395113	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49910	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949777193542033132 12/30/23-06:58:13.628186	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49777	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949822193542814856 12/30/23-06:58:42.080105	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49822	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949771193542033132 12/30/23-06:58:08.096308	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49771	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949779193542033132 12/30/23-06:58:15.550531	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49779	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749912193542033132 12/30/23-06:59:29.368484	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49912	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749894193542814856 12/30/23-06:59:19.912088	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49894	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949824193542814856 12/30/23-06:58:43.090902	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49824	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949826193542814856 12/30/23-06:58:44.099384	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49826	19354	192.168.2.4	18.156.13.209
192.168.2.418.197.239.550081193542033132 12/30/23-07:00:54.154302	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50081	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949828193542814856 12/30/23-06:58:45.123472	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49828	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749890193542814856 12/30/23-06:59:17.969044	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49890	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749892193542814856 12/30/23-06:59:18.951027	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49892	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949841193542033132 12/30/23-06:58:52.214516	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49841	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749908193542033132 12/30/23-06:59:26.520668	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49908	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749918193542033132 12/30/23-06:59:32.288100	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49918	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749906193542033132 12/30/23-06:59:25.530242	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49906	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850007193542033132 12/30/23-07:00:17.003332	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50007	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749904193542033132 12/30/23-06:59:24.562802	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49904	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749914193542033132 12/30/23-06:59:30.329855	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49914	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850009193542033132 12/30/23-07:00:17.992635	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50009	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949820193542814856 12/30/23-06:58:41.006653	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49820	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949775193542033132 12/30/23-06:58:11.898804	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49775	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749916193542033132 12/30/23-06:59:31.315995	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49916	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949764193542033132 12/30/23-06:57:59.930348	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49764	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749900193542033132 12/30/23-06:59:22.575675	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49900	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749921193542033132 12/30/23-06:59:33.759908	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49921	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749902193542033132 12/30/23-06:59:23.554900	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49902	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949766193542033132 12/30/23-06:58:02.485767	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49766	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949787193542033132 12/30/23-06:58:21.859503	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49787	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949811193542814856 12/30/23-06:58:36.302287	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49811	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749923193542033132 12/30/23-06:59:34.726286	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49923	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949768193542033132 12/30/23-06:58:04.876943	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49768	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949789193542033132 12/30/23-06:58:23.169791	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49789	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949834193542814856 12/30/23-06:58:48.171147	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49834	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949813193542814856 12/30/23-06:58:37.354950	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49813	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949815193542814856 12/30/23-06:58:38.422230	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49815	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949836193542814856 12/30/23-06:58:49.179643	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49836	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949817193542814856 12/30/23-06:58:39.473534	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49817	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949838193542814856 12/30/23-06:58:50.173808	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49838	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949843193542033132 12/30/23-06:58:53.218383	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49843	19354	192.168.2.4	18.156.13.209
192.168.2.418.197.239.550066193542033132 12/30/23-07:00:46.770843	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50066	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749879193542814856 12/30/23-06:59:12.631314	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49879	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850010193542033132 12/30/23-07:00:18.477026	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50010	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949845193542033132 12/30/23-06:58:54.222789	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49845	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949819193542814856 12/30/23-06:58:40.501000	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49819	19354	192.168.2.4	18.156.13.209
192.168.2.418.197.239.550064193542033132 12/30/23-07:00:45.792625	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50064	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949847193542033132 12/30/23-06:58:55.219909	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49847	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749875193542814856 12/30/23-06:59:09.576470	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49875	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749896193542814856 12/30/23-06:59:20.882239	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49896	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749877193542814856 12/30/23-06:59:11.657337	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49877	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749898193542814856 12/30/23-06:59:21.850035	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49898	19354	192.168.2.4	3.127.138.57
192.168.2.418.197.239.550068193542033132 12/30/23-07:00:47.740606	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50068	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949795193542033132 12/30/23-06:58:26.878298	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49795	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749932193542033132 12/30/23-06:59:39.117147	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49932	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749756193542814856 12/30/23-06:57:48.292899	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49756	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949794193542033132 12/30/23-06:58:26.283659	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49794	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949798193542033132 12/30/23-06:58:28.628830	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49798	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949791193542033132 12/30/23-06:58:24.422556	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49791	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949799193542033132 12/30/23-06:58:29.212613	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49799	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749906193542814856 12/30/23-06:59:25.770785	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49906	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749752193542814856 12/30/23-06:57:39.966123	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49752	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749751193542814856 12/30/23-06:57:37.519223	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49751	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749759193542814856 12/30/23-06:57:51.839689	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49759	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949801193542814856 12/30/23-06:58:30.584406	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49801	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949802193542814856 12/30/23-06:58:31.147560	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49802	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749907193542814856 12/30/23-06:59:26.275930	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49907	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749933193542033132 12/30/23-06:59:39.601760	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49933	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749873193542814856 12/30/23-06:59:08.594471	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49873	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949764193542814856 12/30/23-06:58:00.172622	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49764	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949765193542814856 12/30/23-06:58:01.473265	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49765	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749902193542814856 12/30/23-06:59:23.793402	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49902	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850015193542033132 12/30/23-07:00:21.543091	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50015	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749872193542814856 12/30/23-06:59:08.108252	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49872	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850014193542033132 12/30/23-07:00:20.575513	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50014	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949790193542033132 12/30/23-06:58:23.797823	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49790	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749899193542033132 12/30/23-06:59:22.091446	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49899	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850011193542033132 12/30/23-07:00:18.962037	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50011	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949831193542033132 12/30/23-06:58:46.408297	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49831	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749755193542814856 12/30/23-06:57:46.372600	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49755	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949832193542033132 12/30/23-06:58:46.906902	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49832	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949805193542814856 12/30/23-06:58:32.805845	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49805	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949806193542814856 12/30/23-06:58:33.355460	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49806	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749903193542814856 12/30/23-06:59:24.315420	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49903	19354	192.168.2.4	3.127.138.57
192.168.2.418.197.239.550060193542033132 12/30/23-07:00:43.834106	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50060	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749929193542033132 12/30/23-06:59:37.653403	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49929	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850018193542033132 12/30/23-07:00:22.786929	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50018	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850029193542033132 12/30/23-07:00:28.229769	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50029	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949779193542814856 12/30/23-06:58:15.792812	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49779	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749936193542033132 12/30/23-06:59:41.043152	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49936	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949768193542814856 12/30/23-06:58:05.118313	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49768	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949769193542814856 12/30/23-06:58:06.230283	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49769	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749925193542033132 12/30/23-06:59:35.700120	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49925	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749926193542033132 12/30/23-06:59:36.181869	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49926	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850019193542033132 12/30/23-07:00:23.274007	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50019	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949785193542033132 12/30/23-06:58:20.502867	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49785	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749937193542033132 12/30/23-06:59:41.527798	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49937	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949784193542033132 12/30/23-06:58:19.803732	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49784	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749745193542814856 12/30/23-06:57:21.884586	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49745	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949780193542033132 12/30/23-06:58:16.840242	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49780	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949781193542033132 12/30/23-06:58:17.605537	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49781	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749741193542814856 12/30/23-06:57:11.514602	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49741	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749749193542814856 12/30/23-06:57:32.353860	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49749	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749761193542814856 12/30/23-06:57:55.069798	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49761	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949776193542814856 12/30/23-06:58:13.018301	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49776	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749748193542814856 12/30/23-06:57:29.753082	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49748	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949775193542814856 12/30/23-06:58:12.140545	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49775	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850005193542033132 12/30/23-07:00:16.032843	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50005	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850026193542033132 12/30/23-07:00:26.716616	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50026	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749862193542814856 12/30/23-06:59:03.086640	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49862	19354	192.168.2.4	3.127.138.57
192.168.2.418.197.239.550070193542033132 12/30/23-07:00:48.719328	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50070	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749883193542814856 12/30/23-06:59:14.575085	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49883	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749861193542814856 12/30/23-06:59:02.584434	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49861	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850004193542033132 12/30/23-07:00:15.549435	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50004	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850025193542033132 12/30/23-07:00:26.230594	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50025	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749882193542814856 12/30/23-06:59:14.082439	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49882	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949771193542814856 12/30/23-06:58:08.334196	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49771	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850001193542033132 12/30/23-07:00:14.107818	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50001	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850022193542033132 12/30/23-07:00:24.731564	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50022	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550073193542033132 12/30/23-07:00:50.186982	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50073	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949772193542814856 12/30/23-06:58:09.337276	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49772	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749744193542814856 12/30/23-06:57:19.294692	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49744	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850059193542814856 12/30/23-07:00:43.466411	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50059	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550077193542033132 12/30/23-07:00:52.186665	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50077	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949814193542033132 12/30/23-06:58:37.646709	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49814	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949835193542033132 12/30/23-06:58:48.442153	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49835	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749892193542033132 12/30/23-06:59:18.710203	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49892	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850058193542814856 12/30/23-07:00:42.973648	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50058	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550078193542033132 12/30/23-07:00:52.683987	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50078	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749891193542033132 12/30/23-06:59:18.218918	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49891	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749895193542033132 12/30/23-06:59:20.153537	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49895	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749869193542814856 12/30/23-06:59:06.630731	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49869	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850000193542033132 12/30/23-07:00:13.595230	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50000	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850021193542033132 12/30/23-07:00:24.247127	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50021	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749896193542033132 12/30/23-06:59:20.640929	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49896	19354	192.168.2.4	3.127.138.57
192.168.2.418.197.239.550074193542033132 12/30/23-07:00:50.682277	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50074	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949815193542033132 12/30/23-06:58:38.185220	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49815	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949836193542033132 12/30/23-06:58:48.938117	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49836	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949809193542814856 12/30/23-06:58:35.250061	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49809	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749920193542814856 12/30/23-06:59:33.515224	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49920	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749865193542814856 12/30/23-06:59:04.588452	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49865	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749886193542814856 12/30/23-06:59:16.032780	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49886	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749866193542814856 12/30/23-06:59:05.087576	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49866	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850055193542814856 12/30/23-07:00:41.504089	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50055	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949839193542033132 12/30/23-06:58:50.449348	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49839	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749887193542814856 12/30/23-06:59:16.514863	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49887	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949818193542033132 12/30/23-06:58:39.751349	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49818	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949819193542033132 12/30/23-06:58:40.262690	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49819	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850054193542814856 12/30/23-07:00:41.016431	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50054	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749911193542033132 12/30/23-06:59:28.906034	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49911	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749953193542033132 12/30/23-06:59:49.899296	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49953	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949774193542033132 12/30/23-06:58:10.980764	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49774	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949770193542033132 12/30/23-06:58:07.067339	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49770	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949778193542033132 12/30/23-06:58:14.453525	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49778	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749927193542814856 12/30/23-06:59:36.906209	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49927	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849977193542033132 12/30/23-07:00:01.827518	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49977	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749730193542814856 12/30/23-06:56:58.554147	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49730	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949823193542814856 12/30/23-06:58:42.580546	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49823	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749923193542814856 12/30/23-06:59:34.964003	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49923	19354	192.168.2.4	3.127.138.57
192.168.2.418.197.239.550080193542033132 12/30/23-07:00:53.665144	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50080	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749851193542814856 12/30/23-06:58:57.593735	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49851	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949786193542814856 12/30/23-06:58:21.432065	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49786	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1849973193542033132 12/30/23-06:59:59.823165	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49973	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749878193542033132 12/30/23-06:59:11.903318	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49878	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849989193542814856 12/30/23-07:00:08.436279	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49989	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749893193542814856 12/30/23-06:59:19.436193	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49893	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850036193542033132 12/30/23-07:00:31.626776	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50036	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949782193542814856 12/30/23-06:58:18.587636	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49782	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749760193542033132 12/30/23-06:57:53.252164	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49760	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949811193542033132 12/30/23-06:58:36.061798	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49811	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949827193542814856 12/30/23-06:58:44.610808	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49827	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1849995193542814856 12/30/23-07:00:11.352583	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49995	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849985193542814856 12/30/23-07:00:06.458086	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49985	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849981193542814856 12/30/23-07:00:04.500208	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49981	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849991193542814856 12/30/23-07:00:09.404969	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49991	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849999193542814856 12/30/23-07:00:13.331950	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49999	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749909193542033132 12/30/23-06:59:27.121367	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49909	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749919193542033132 12/30/23-06:59:32.776505	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49919	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850008193542033132 12/30/23-07:00:17.503665	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50008	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749957193542033132 12/30/23-06:59:51.858230	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49957	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749915193542033132 12/30/23-06:59:30.824594	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49915	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749947193542033132 12/30/23-06:59:46.987477	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49947	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749905193542033132 12/30/23-06:59:25.049008	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49905	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749964193542033132 12/30/23-06:59:55.271906	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49964	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749922193542033132 12/30/23-06:59:34.244220	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49922	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749943193542033132 12/30/23-06:59:44.719248	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49943	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849987193542033132 12/30/23-07:00:07.206315	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49987	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949767193542033132 12/30/23-06:58:03.713667	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49767	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949788193542033132 12/30/23-06:58:22.517327	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49788	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749959193542814856 12/30/23-06:59:53.069861	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49959	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849966193542033132 12/30/23-06:59:56.364852	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49966	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949833193542814856 12/30/23-06:58:47.656166	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49833	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749938193542814856 12/30/23-06:59:42.272685	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49938	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949812193542814856 12/30/23-06:58:36.835456	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49812	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749901193542033132 12/30/23-06:59:23.075689	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49901	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749917193542814856 12/30/23-06:59:32.043952	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49917	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749955193542814856 12/30/23-06:59:51.120533	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49955	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749868193542033132 12/30/23-06:59:05.905389	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49868	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749889193542033132 12/30/23-06:59:17.247936	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49889	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949837193542814856 12/30/23-06:58:49.679623	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49837	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749934193542814856 12/30/23-06:59:40.323985	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49934	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849978193542814856 12/30/23-07:00:02.576014	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49978	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849983193542033132 12/30/23-07:00:05.234340	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49983	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749960193542033132 12/30/23-06:59:53.321128	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49960	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949842193542033132 12/30/23-06:58:52.917769	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49842	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949800193542033132 12/30/23-06:58:29.782591	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49800	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949816193542814856 12/30/23-06:58:38.952892	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49816	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949821193542033132 12/30/23-06:58:41.279188	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49821	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749913193542814856 12/30/23-06:59:30.084234	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49913	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850006193542814856 12/30/23-07:00:16.760624	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50006	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749859193542814856 12/30/23-06:59:01.585982	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49859	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850048193542814856 12/30/23-07:00:37.736713	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50048	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550067193542033132 12/30/23-07:00:47.256829	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50067	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749860193542033132 12/30/23-06:59:01.845457	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49860	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749881193542033132 12/30/23-06:59:13.355381	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49881	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949846193542033132 12/30/23-06:58:54.722012	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49846	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850027193542814856 12/30/23-07:00:27.496245	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50027	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850032193542033132 12/30/23-07:00:29.691730	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50032	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749951193542814856 12/30/23-06:59:49.163586	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49951	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850002193542814856 12/30/23-07:00:14.817994	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50002	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550063193542033132 12/30/23-07:00:45.301340	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50063	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749864193542033132 12/30/23-06:59:03.844410	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49864	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749885193542033132 12/30/23-06:59:15.300659	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49885	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850053193542033132 12/30/23-07:00:40.266642	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50053	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749930193542814856 12/30/23-06:59:38.383930	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49930	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949804193542033132 12/30/23-06:58:32.016402	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49804	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949825193542033132 12/30/23-06:58:43.358709	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49825	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850040193542814856 12/30/23-07:00:33.829919	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50040	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749897193542814856 12/30/23-06:59:21.371867	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49897	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850023193542814856 12/30/23-07:00:25.504623	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50023	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850044193542814856 12/30/23-07:00:35.791284	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50044	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749855193542814856 12/30/23-06:58:59.561215	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49855	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749747193542033132 12/30/23-06:57:26.909123	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49747	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949808193542033132 12/30/23-06:58:34.389036	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49808	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949829193542033132 12/30/23-06:58:45.412490	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49829	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1849998193542033132 12/30/23-07:00:12.595313	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49998	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749741193542033132 12/30/23-06:57:11.270022	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49741	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749948193542814856 12/30/23-06:59:47.711739	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49948	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749949193542814856 12/30/23-06:59:48.194602	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49949	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749743193542033132 12/30/23-06:57:16.443459	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49743	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849999193542033132 12/30/23-07:00:13.088344	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49999	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749742193542033132 12/30/23-06:57:13.847951	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49742	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749944193542814856 12/30/23-06:59:45.216851	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49944	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849993193542033132 12/30/23-07:00:10.142760	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49993	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850058193542033132 12/30/23-07:00:42.731334	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50058	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749943193542814856 12/30/23-06:59:44.723176	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49943	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749945193542814856 12/30/23-06:59:46.180591	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49945	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850057193542033132 12/30/23-07:00:42.242902	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50057	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850059193542033132 12/30/23-07:00:43.221744	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50059	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749857193542033132 12/30/23-06:59:00.347550	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49857	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749859193542033132 12/30/23-06:59:01.345120	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49859	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849994193542033132 12/30/23-07:00:10.626827	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49994	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749856193542033132 12/30/23-06:58:59.842821	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49856	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849967193542814856 12/30/23-06:59:57.092698	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49967	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849997193542033132 12/30/23-07:00:12.105095	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49997	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850054193542033132 12/30/23-07:00:40.775184	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50054	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749947193542814856 12/30/23-06:59:47.226861	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49947	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850055193542033132 12/30/23-07:00:41.261760	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50055	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849968193542814856 12/30/23-06:59:57.609467	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49968	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749946193542814856 12/30/23-06:59:46.733187	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49946	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849995193542033132 12/30/23-07:00:11.110412	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49995	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850056193542033132 12/30/23-07:00:41.748672	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50056	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849996193542033132 12/30/23-07:00:11.636031	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49996	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749858193542033132 12/30/23-06:59:00.844263	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49858	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849969193542814856 12/30/23-06:59:58.095277	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49969	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850029193542814856 12/30/23-07:00:28.466902	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50029	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849973193542814856 12/30/23-07:00:00.069190	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49973	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849970193542814856 12/30/23-06:59:58.576787	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49970	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849974193542814856 12/30/23-07:00:00.562308	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49974	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849977193542814856 12/30/23-07:00:02.069880	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49977	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749747193542825564 12/30/23-06:57:27.233979	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49747	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849966193542814856 12/30/23-06:59:56.605198	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49966	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849975193542814856 12/30/23-07:00:01.086540	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49975	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849991193542033132 12/30/23-07:00:09.163787	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49991	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849976193542814856 12/30/23-07:00:01.573004	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49976	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849992193542033132 12/30/23-07:00:09.652740	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49992	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849965193542814856 12/30/23-06:59:56.116605	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49965	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849990193542033132 12/30/23-07:00:08.679646	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49990	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849971193542814856 12/30/23-06:59:59.069362	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49971	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849972193542814856 12/30/23-06:59:59.556918	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49972	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749751193542033132 12/30/23-06:57:37.279473	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49751	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749730193542033132 12/30/23-06:56:58.314971	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49730	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749731193542033132 12/30/23-06:57:00.892532	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49731	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949799193542814856 12/30/23-06:58:29.449482	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49799	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749752193542033132 12/30/23-06:57:39.791208	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49752	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949798193542814856 12/30/23-06:58:28.873869	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49798	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850049193542033132 12/30/23-07:00:38.002839	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50049	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749732193542033132 12/30/23-06:57:03.485136	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49732	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749753193542033132 12/30/23-06:57:41.950785	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49753	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949796193542814856 12/30/23-06:58:27.711457	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49796	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850047193542033132 12/30/23-07:00:37.016103	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50047	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949797193542814856 12/30/23-06:58:28.289196	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49797	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850046193542033132 12/30/23-07:00:36.524654	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50046	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850048193542033132 12/30/23-07:00:37.496687	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50048	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949795193542814856 12/30/23-06:58:27.120834	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49795	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850043193542033132 12/30/23-07:00:35.064965	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50043	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850044193542033132 12/30/23-07:00:35.550765	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50044	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749750193542033132 12/30/23-06:57:34.687734	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49750	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949793193542814856 12/30/23-06:58:25.915869	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49793	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850019193542814856 12/30/23-07:00:23.516431	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50019	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850045193542033132 12/30/23-07:00:36.039234	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50045	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850018193542814856 12/30/23-07:00:23.027394	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50018	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949794193542814856 12/30/23-06:58:26.526085	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49794	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749849193542814856 12/30/23-06:58:56.589692	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49849	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850017193542814856 12/30/23-07:00:22.536265	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50017	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850038193542814856 12/30/23-07:00:32.847377	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50038	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749871193542033132 12/30/23-06:59:07.380827	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49871	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749872193542033132 12/30/23-06:59:07.866667	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49872	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749848193542814856 12/30/23-06:58:56.080050	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49848	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850037193542814856 12/30/23-07:00:32.357774	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50037	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850039193542814856 12/30/23-07:00:33.338541	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50039	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749851193542033132 12/30/23-06:58:57.350136	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49851	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850040193542033132 12/30/23-07:00:33.587063	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50040	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749870193542033132 12/30/23-06:59:06.892440	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49870	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749873193542033132 12/30/23-06:59:08.354127	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49873	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749874193542033132 12/30/23-06:59:08.860526	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49874	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850016193542814856 12/30/23-07:00:22.047418	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50016	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949792193542814856 12/30/23-06:58:25.292661	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49792	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749852193542033132 12/30/23-06:58:57.840227	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49852	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749940193542814856 12/30/23-06:59:43.253908	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49940	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850013193542814856 12/30/23-07:00:20.180218	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50013	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850034193542814856 12/30/23-07:00:30.897052	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50034	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749875193542033132 12/30/23-06:59:09.335661	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49875	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749876193542033132 12/30/23-06:59:11.164509	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49876	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749941193542814856 12/30/23-06:59:43.737971	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49941	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749962193542814856 12/30/23-06:59:54.541480	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49962	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850035193542814856 12/30/23-07:00:31.380008	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50035	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949791193542814856 12/30/23-06:58:24.664666	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49791	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749853193542033132 12/30/23-06:58:58.326027	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49853	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749855193542033132 12/30/23-06:58:59.316698	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49855	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850042193542033132 12/30/23-07:00:34.574205	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50042	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749942193542814856 12/30/23-06:59:44.234619	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49942	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749963193542814856 12/30/23-06:59:55.027646	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49963	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850036193542814856 12/30/23-07:00:31.869023	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50036	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850014193542814856 12/30/23-07:00:20.683832	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50014	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949790193542814856 12/30/23-06:58:24.039838	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49790	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749854193542033132 12/30/23-06:58:58.817855	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49854	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850041193542033132 12/30/23-07:00:34.083405	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50041	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850030193542814856 12/30/23-07:00:28.954437	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50030	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749735193542033132 12/30/23-06:57:08.663103	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49735	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850031193542814856 12/30/23-07:00:29.445787	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50031	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749754193542033132 12/30/23-06:57:44.074834	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49754	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749756193542033132 12/30/23-06:57:48.050572	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49756	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749733193542033132 12/30/23-06:57:06.081901	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49733	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850012193542814856 12/30/23-07:00:19.695001	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50012	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749755193542033132 12/30/23-06:57:46.129320	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49755	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749759193542033132 12/30/23-06:57:51.599816	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49759	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749729193542814856 12/30/23-06:56:56.048636	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49729	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749961193542814856 12/30/23-06:59:54.054177	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49961	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850033193542814856 12/30/23-07:00:30.416672	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50033	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850011193542814856 12/30/23-07:00:19.203057	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50011	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850032193542814856 12/30/23-07:00:29.928847	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50032	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749960193542814856 12/30/23-06:59:53.565099	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49960	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850010193542814856 12/30/23-07:00:18.717437	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50010	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749757193542033132 12/30/23-06:57:49.875086	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49757	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749850193542033132 12/30/23-06:58:56.842955	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49850	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749952193542033132 12/30/23-06:59:49.412198	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49952	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749954193542033132 12/30/23-06:59:50.385891	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49954	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749735193542814856 12/30/23-06:57:08.903912	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49735	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849976193542033132 12/30/23-07:00:01.334423	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49976	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749956193542033132 12/30/23-06:59:51.364436	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49956	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850039193542033132 12/30/23-07:00:33.093585	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50039	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850050193542814856 12/30/23-07:00:38.709977	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50050	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949787193542814856 12/30/23-06:58:22.099907	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49787	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749928193542814856 12/30/23-06:59:37.398460	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49928	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849978193542033132 12/30/23-07:00:02.331532	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49978	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749879193542033132 12/30/23-06:59:12.389730	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49879	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749964193542814856 12/30/23-06:59:55.513903	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49964	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850035193542033132 12/30/23-07:00:31.140226	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50035	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850037193542033132 12/30/23-07:00:32.119237	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50037	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749850193542814856 12/30/23-06:58:57.083342	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49850	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749877193542033132 12/30/23-06:59:11.416435	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49877	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749731193542814856 12/30/23-06:57:01.133659	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49731	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749922193542814856 12/30/23-06:59:34.483645	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49922	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749926193542814856 12/30/23-06:59:36.421423	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49926	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949785193542814856 12/30/23-06:58:20.746863	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49785	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1849972193542033132 12/30/23-06:59:59.314289	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49972	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749761193542033132 12/30/23-06:57:54.828622	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49761	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949810193542033132 12/30/23-06:58:35.529677	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49810	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749950193542033132 12/30/23-06:59:48.439896	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49950	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850033193542033132 12/30/23-07:00:30.175204	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50033	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749733193542814856 12/30/23-06:57:06.321693	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49733	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749924193542814856 12/30/23-06:59:35.446750	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49924	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850007193542814856 12/30/23-07:00:17.242018	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50007	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949783193542814856 12/30/23-06:58:19.316332	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49783	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1849974193542033132 12/30/23-07:00:00.317197	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49974	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849984193542814856 12/30/23-07:00:05.970954	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49984	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849994193542814856 12/30/23-07:00:10.865713	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49994	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849992193542814856 12/30/23-07:00:09.897175	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49992	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849996193542814856 12/30/23-07:00:11.851716	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49996	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850009193542814856 12/30/23-07:00:18.231993	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50009	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849980193542814856 12/30/23-07:00:04.012515	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49980	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849988193542814856 12/30/23-07:00:07.946788	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49988	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849990193542814856 12/30/23-07:00:08.920614	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49990	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849998193542814856 12/30/23-07:00:12.837253	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49998	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849980193542033132 12/30/23-07:00:03.827429	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49980	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849970193542033132 12/30/23-06:59:58.337721	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49970	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849986193542814856 12/30/23-07:00:06.958269	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49986	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949789193542814856 12/30/23-06:58:23.407334	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49789	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749958193542033132 12/30/23-06:59:52.342235	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49958	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849982193542814856 12/30/23-07:00:04.987660	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49982	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749948193542033132 12/30/23-06:59:47.472154	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49948	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849969193542033132 12/30/23-06:59:57.853566	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49969	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749963193542033132 12/30/23-06:59:54.785800	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49963	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749942193542033132 12/30/23-06:59:43.992910	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49942	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749946193542033132 12/30/23-06:59:46.488338	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49946	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749916193542814856 12/30/23-06:59:31.555556	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49916	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849988193542033132 12/30/23-07:00:07.700870	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49988	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749918193542814856 12/30/23-06:59:32.529835	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49918	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849967193542033132 12/30/23-06:59:56.850603	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49967	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749939193542814856 12/30/23-06:59:42.759589	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49939	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749944193542033132 12/30/23-06:59:44.971902	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49944	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749869193542033132 12/30/23-06:59:06.391520	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49869	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749912193542814856 12/30/23-06:59:29.607772	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49912	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749954193542814856 12/30/23-06:59:50.627454	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49954	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749848193542033132 12/30/23-06:58:55.841355	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49848	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849982193542033132 12/30/23-07:00:04.772515	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49982	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849984193542033132 12/30/23-07:00:05.732245	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49984	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749867193542033132 12/30/23-06:59:05.403704	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49867	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749888193542033132 12/30/23-06:59:16.761193	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49888	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749933193542814856 12/30/23-06:59:39.842196	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49933	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749937193542814856 12/30/23-06:59:41.768490	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49937	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849965193542033132 12/30/23-06:59:55.878341	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49965	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949820193542033132 12/30/23-06:58:40.765520	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49820	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749958193542814856 12/30/23-06:59:52.581860	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49958	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749961193542033132 12/30/23-06:59:53.811310	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49961	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849986193542033132 12/30/23-07:00:06.716982	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49986	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749914193542814856 12/30/23-06:59:30.573264	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49914	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849979193542814856 12/30/23-07:00:03.071228	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49979	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949822193542033132 12/30/23-06:58:41.834391	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49822	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749956193542814856 12/30/23-06:59:51.605514	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49956	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749935193542814856 12/30/23-06:59:40.802367	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49935	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749940193542033132 12/30/23-06:59:43.008933	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49940	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749861193542033132 12/30/23-06:59:02.343732	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49861	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749882193542033132 12/30/23-06:59:13.841892	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49882	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850050193542033132 12/30/23-07:00:38.576098	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50050	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949824193542033132 12/30/23-06:58:42.848389	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49824	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850049193542814856 12/30/23-07:00:38.223716	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50049	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949801193542033132 12/30/23-06:58:30.343483	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49801	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949803193542033132 12/30/23-06:58:31.468455	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49803	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850026193542814856 12/30/23-07:00:26.960595	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50026	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850028193542814856 12/30/23-07:00:27.990273	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50028	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749858193542814856 12/30/23-06:59:01.085903	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49858	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749863193542033132 12/30/23-06:59:03.347715	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49863	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749884193542033132 12/30/23-06:59:14.818821	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49884	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749880193542033132 12/30/23-06:59:12.872848	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49880	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850005193542814856 12/30/23-07:00:16.273723	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50005	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949781193542814856 12/30/23-06:58:17.843270	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49781	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749865193542033132 12/30/23-06:59:04.346123	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49865	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749886193542033132 12/30/23-06:59:15.787605	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49886	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850045193542814856 12/30/23-07:00:36.282306	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50045	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949805193542033132 12/30/23-06:58:32.563530	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49805	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850024193542814856 12/30/23-07:00:25.988529	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50024	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850031193542033132 12/30/23-07:00:29.206057	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50031	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749910193542814856 12/30/23-06:59:28.641541	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49910	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850052193542033132 12/30/23-07:00:39.896763	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50052	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749729193542033132 12/30/23-06:56:55.865512	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49729	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949826193542033132 12/30/23-06:58:43.862219	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49826	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749952193542814856 12/30/23-06:59:49.653812	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49952	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850047193542814856 12/30/23-07:00:37.254319	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50047	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850003193542814856 12/30/23-07:00:15.304449	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50003	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749931193542814856 12/30/23-06:59:38.869094	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49931	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749852193542814856 12/30/23-06:58:58.076573	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49852	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850041193542814856 12/30/23-07:00:34.323025	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50041	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949809193542033132 12/30/23-06:58:35.007968	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49809	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850020193542814856 12/30/23-07:00:24.001117	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50020	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749854193542814856 12/30/23-06:58:59.057474	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49854	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850001193542814856 12/30/23-07:00:14.328187	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50001	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749744193542033132 12/30/23-06:57:19.050041	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49744	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749748193542033132 12/30/23-06:57:29.511857	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49748	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749856193542814856 12/30/23-06:59:00.087695	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49856	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949828193542033132 12/30/23-06:58:44.882263	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49828	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749950193542814856 12/30/23-06:59:48.676663	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49950	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949807193542033132 12/30/23-06:58:34.079878	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49807	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850022193542814856 12/30/23-07:00:24.973826	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50022	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850043193542814856 12/30/23-07:00:35.308067	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50043	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749746193542033132 12/30/23-06:57:24.324942	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49746	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749757193542814856 12/30/23-06:57:50.114659	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49757	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749909193542814856 12/30/23-06:59:27.358945	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49909	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749908193542814856 12/30/23-06:59:26.758826	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49908	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749931193542033132 12/30/23-06:59:38.628084	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49931	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749935193542033132 12/30/23-06:59:40.565444	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49935	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949800193542814856 12/30/23-06:58:30.022010	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49800	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749905193542814856 12/30/23-06:59:25.286864	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49905	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949793193542033132 12/30/23-06:58:25.674401	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49793	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749934193542033132 12/30/23-06:59:40.085126	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49934	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949766193542814856 12/30/23-06:58:02.727133	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49766	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850017193542033132 12/30/23-07:00:22.313219	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50017	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949792193542033132 12/30/23-06:58:25.052320	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49792	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949803193542814856 12/30/23-06:58:31.707862	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49803	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949804193542814856 12/30/23-06:58:32.258279	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49804	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749901193542814856 12/30/23-06:59:23.312951	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49901	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850016193542033132 12/30/23-07:00:21.897628	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50016	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749871193542814856 12/30/23-06:59:07.622024	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49871	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949763193542814856 12/30/23-06:57:58.790672	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49763	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749900193542814856 12/30/23-06:59:22.817240	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49900	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749904193542814856 12/30/23-06:59:24.806589	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49904	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749753193542814856 12/30/23-06:57:42.189827	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49753	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850012193542033132 12/30/23-07:00:19.451840	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50012	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550062193542033132 12/30/23-07:00:44.811642	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50062	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749754193542814856 12/30/23-06:57:44.316818	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49754	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749870193542814856 12/30/23-06:59:07.134679	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49870	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749930193542033132 12/30/23-06:59:38.144940	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49930	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949762193542814856 12/30/23-06:57:56.779496	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49762	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850013193542033132 12/30/23-07:00:19.939025	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50013	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550061193542033132 12/30/23-07:00:44.320331	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50061	19354	192.168.2.4	18.197.239.5
192.168.2.418.156.13.20949830193542033132 12/30/23-06:58:45.902361	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49830	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749760193542814856 12/30/23-06:57:53.493964	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49760	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749750193542814856 12/30/23-06:57:34.929638	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49750	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949767193542814856 12/30/23-06:58:03.958715	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49767	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749928193542033132 12/30/23-06:59:37.157075	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49928	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949778193542814856 12/30/23-06:58:14.688767	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49778	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749939193542033132 12/30/23-06:59:42.518313	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49939	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949786193542033132 12/30/23-06:58:21.190683	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49786	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949797193542033132 12/30/23-06:58:28.048530	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49797	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749938193542033132 12/30/23-06:59:42.031161	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49938	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749927193542033132 12/30/23-06:59:36.665802	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49927	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949796193542033132 12/30/23-06:58:27.470586	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49796	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749747193542814856 12/30/23-06:57:27.150655	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49747	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949783193542033132 12/30/23-06:58:19.076238	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49783	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749746193542814856 12/30/23-06:57:24.568832	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49746	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949777193542814856 12/30/23-06:58:13.872631	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49777	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850028193542033132 12/30/23-07:00:27.745382	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50028	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949782193542033132 12/30/23-06:58:18.344993	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49782	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850006193542033132 12/30/23-07:00:16.520244	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50006	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850027193542033132 12/30/23-07:00:27.255013	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50027	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850003193542033132 12/30/23-07:00:15.062948	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50003	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749860193542814856 12/30/23-06:59:02.085316	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49860	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949774193542814856 12/30/23-06:58:11.217163	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49774	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749742193542814856 12/30/23-06:57:14.088663	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49742	19354	192.168.2.4	3.127.138.57
192.168.2.418.197.239.550072193542033132 12/30/23-07:00:49.694789	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50072	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749743193542814856 12/30/23-06:57:16.689114	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49743	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749881193542814856 12/30/23-06:59:13.594722	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49881	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949773193542814856 12/30/23-06:58:10.300191	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49773	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850024193542033132 12/30/23-07:00:25.751103	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50024	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550071193542033132 12/30/23-07:00:49.200940	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50071	19354	192.168.2.4	18.197.239.5
192.168.2.43.126.37.1850002193542033132 12/30/23-07:00:14.574938	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50002	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850023193542033132 12/30/23-07:00:25.261896	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50023	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749880193542814856 12/30/23-06:59:13.111628	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49880	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949813193542033132 12/30/23-06:58:37.111513	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49813	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949834193542033132 12/30/23-06:58:47.933226	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49834	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749893193542033132 12/30/23-06:59:19.207463	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49893	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949812193542033132 12/30/23-06:58:36.594044	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49812	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949833193542033132 12/30/23-06:58:47.410751	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49833	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749894193542033132 12/30/23-06:59:19.676849	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49894	19354	192.168.2.4	3.127.138.57
192.168.2.418.197.239.550076193542033132 12/30/23-07:00:51.670271	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50076	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749868193542814856 12/30/23-06:59:06.145562	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49868	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949770193542814856 12/30/23-06:58:07.306224	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49770	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949838193542033132 12/30/23-06:58:49.935180	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49838	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749897193542033132 12/30/23-06:59:21.130355	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49897	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949808193542814856 12/30/23-06:58:34.624993	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49808	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949816193542033132 12/30/23-06:58:38.707245	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49816	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949837193542033132 12/30/23-06:58:49.437993	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49837	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749890193542033132 12/30/23-06:59:17.730882	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49890	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749898193542033132 12/30/23-06:59:21.612585	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49898	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850056193542814856 12/30/23-07:00:41.990891	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50056	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749921193542814856 12/30/23-06:59:34.001695	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49921	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850020193542033132 12/30/23-07:00:23.762339	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50020	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850057193542814856 12/30/23-07:00:42.486869	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50057	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550075193542033132 12/30/23-07:00:51.177057	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50075	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749884193542814856 12/30/23-06:59:15.059251	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49884	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749863193542814856 12/30/23-06:59:03.591806	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49863	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850052193542814856 12/30/23-07:00:40.013512	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50052	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749885193542814856 12/30/23-06:59:15.538707	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49885	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749864193542814856 12/30/23-06:59:04.086040	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49864	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749747193542814860 12/30/23-06:57:27.233979	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49747	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949817193542033132 12/30/23-06:58:39.233276	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49817	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749867193542814856 12/30/23-06:59:05.648160	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49867	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749889193542814856 12/30/23-06:59:17.489613	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49889	19354	192.168.2.4	3.127.138.57
192.168.2.418.197.239.550079193542033132 12/30/23-07:00:53.177189	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50079	19354	192.168.2.4	18.197.239.5
192.168.2.43.126.37.1850053193542814856 12/30/23-07:00:40.509000	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50053	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749888193542814856 12/30/23-06:59:17.003077	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49888	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749929193542814856 12/30/23-06:59:37.897152	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49929	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849979193542033132 12/30/23-07:00:02.833960	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49979	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749913193542033132 12/30/23-06:59:29.847668	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49913	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949772193542033132 12/30/23-06:58:09.095731	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49772	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949776193542033132 12/30/23-06:58:12.779493	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49776	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949788193542814856 12/30/23-06:58:22.759732	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49788	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749955193542033132 12/30/23-06:59:50.878260	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49955	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850038193542033132 12/30/23-07:00:32.609416	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50038	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949825193542814856 12/30/23-06:58:43.598734	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49825	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1849971193542033132 12/30/23-06:59:58.824501	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49971	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949784193542814856 12/30/23-06:58:20.048612	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49784	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749732193542814856 12/30/23-06:57:03.726887	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49732	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949829193542814856 12/30/23-06:58:45.628952	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49829	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1849975193542033132 12/30/23-07:00:00.846778	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49975	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749925193542814856 12/30/23-06:59:35.937314	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49925	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749951193542033132 12/30/23-06:59:48.922026	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49951	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850008193542814856 12/30/23-07:00:17.739937	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50008	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550082193542033132 12/30/23-07:00:57.990897	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50082	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749891193542814856 12/30/23-06:59:18.463462	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49891	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850034193542033132 12/30/23-07:00:30.660872	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50034	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849987193542814856 12/30/23-07:00:07.450556	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49987	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949840193542033132 12/30/23-06:58:51.058204	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49840	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1849997193542814856 12/30/23-07:00:12.349998	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49997	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849981193542033132 12/30/23-07:00:04.257676	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49981	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749949193542033132 12/30/23-06:59:47.956084	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49949	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749917193542033132 12/30/23-06:59:31.804979	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49917	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749907193542033132 12/30/23-06:59:26.034167	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49907	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949821193542814856 12/30/23-06:58:41.518023	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49821	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949810193542814856 12/30/23-06:58:35.769712	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49810	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749959193542033132 12/30/23-06:59:52.826362	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49959	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849993193542814856 12/30/23-07:00:10.379084	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49993	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849983193542814856 12/30/23-07:00:05.478752	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49983	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1849968193542033132 12/30/23-06:59:57.372313	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49968	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749941193542033132 12/30/23-06:59:43.498607	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49941	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949765193542033132 12/30/23-06:58:01.233628	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49765	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749920193542033132 12/30/23-06:59:33.270015	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49920	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749924193542033132 12/30/23-06:59:35.208692	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49924	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749903193542033132 12/30/23-06:59:24.070627	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49903	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749919193542814856 12/30/23-06:59:33.018377	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49919	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749945193542033132 12/30/23-06:59:46.067668	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49945	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849989193542033132 12/30/23-07:00:08.205585	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49989	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949814193542814856 12/30/23-06:58:37.887301	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49814	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949835193542814856 12/30/23-06:58:48.686724	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49835	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749932193542814856 12/30/23-06:59:39.358213	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49932	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949769193542033132 12/30/23-06:58:05.988000	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49769	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749911193542814856 12/30/23-06:59:29.126763	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49911	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749915193542814856 12/30/23-06:59:31.070055	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49915	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749849193542033132 12/30/23-06:58:56.346466	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49849	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949818193542814856 12/30/23-06:58:39.988518	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49818	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949839193542814856 12/30/23-06:58:50.694196	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49839	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749936193542814856 12/30/23-06:59:41.281512	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49936	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749962193542033132 12/30/23-06:59:54.301440	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49962	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749957193542814856 12/30/23-06:59:52.099962	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49957	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1849985193542033132 12/30/23-07:00:06.216832	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49985	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949802193542033132 12/30/23-06:58:30.906256	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49802	19354	192.168.2.4	18.156.13.209
192.168.2.418.156.13.20949823193542033132 12/30/23-06:58:42.341539	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49823	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749862193542033132 12/30/23-06:59:02.844678	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49862	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749883193542033132 12/30/23-06:59:14.334660	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49883	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850051193542033132 12/30/23-07:00:39.525800	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50051	19354	192.168.2.4	3.126.37.18
192.168.2.418.156.13.20949844193542033132 12/30/23-06:58:53.721212	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49844	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749749193542033132 12/30/23-06:57:32.111036	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49749	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949827193542033132 12/30/23-06:58:44.367837	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49827	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749866193542033132 12/30/23-06:59:04.846811	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49866	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749887193542033132 12/30/23-06:59:16.275491	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49887	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949780193542814856 12/30/23-06:58:17.081603	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49780	19354	192.168.2.4	18.156.13.209
192.168.2.43.126.37.1850004193542814856 12/30/23-07:00:15.787254	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50004	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749953193542814856 12/30/23-06:59:50.142653	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49953	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850046193542814856 12/30/23-07:00:36.764056	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50046	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550065193542033132 12/30/23-07:00:46.284271	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50065	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749895193542814856 12/30/23-06:59:20.392745	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49895	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850025193542814856 12/30/23-07:00:26.469978	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50025	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850030193542033132 12/30/23-07:00:28.712067	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50030	19354	192.168.2.4	3.126.37.18
192.168.2.43.127.138.5749745193542033132 12/30/23-06:57:21.641720	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49745	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749853193542814856 12/30/23-06:58:58.560128	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49853	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749874193542814856 12/30/23-06:59:09.083915	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49874	19354	192.168.2.4	3.127.138.57
192.168.2.418.156.13.20949806193542033132 12/30/23-06:58:33.167163	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49806	19354	192.168.2.4	18.156.13.209
192.168.2.43.127.138.5749857193542814856 12/30/23-06:59:00.592542	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49857	19354	192.168.2.4	3.127.138.57
192.168.2.43.127.138.5749878193542814856 12/30/23-06:59:12.145204	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49878	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850000193542814856 12/30/23-07:00:13.841135	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50000	19354	192.168.2.4	3.126.37.18
192.168.2.43.126.37.1850042193542814856 12/30/23-07:00:34.818033	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50042	19354	192.168.2.4	3.126.37.18
192.168.2.418.197.239.550069193542033132 12/30/23-07:00:48.227392	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50069	19354	192.168.2.4	18.197.239.5
192.168.2.43.127.138.5749899193542814856 12/30/23-06:59:22.330011	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49899	19354	192.168.2.4	3.127.138.57
192.168.2.43.126.37.1850021193542814856 12/30/23-07:00:24.486098	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	50021	19354	192.168.2.4	3.126.37.18

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2023 06:56:55.469639063 CET	49729	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:55.712502003 CET	19354	49729	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:55.712625980 CET	49729	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:55.865511894 CET	49729	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:56.048576117 CET	19354	49729	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:56.048635960 CET	49729	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:56.108165026 CET	19354	49729	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:56.291342020 CET	19354	49729	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:56.327167988 CET	19354	49729	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:56.327183008 CET	19354	49729	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:56.327256918 CET	49729	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:58.073153019 CET	49729	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:58.074419975 CET	49730	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:58.313826084 CET	19354	49730	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:58.313930035 CET	49730	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:58.314970970 CET	49730	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:58.554075956 CET	19354	49730	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:58.554147005 CET	49730	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:58.641149998 CET	19354	49730	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:58.694055080 CET	49730	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:56:58.793492079 CET	19354	49730	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:58.828941107 CET	19354	49730	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:58.829019070 CET	19354	49730	3.127.138.57	192.168.2.4
Dec 30, 2023 06:56:58.829099894 CET	49730	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:00.648231030 CET	49730	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:00.650451899 CET	49731	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:00.891793013 CET	19354	49731	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:00.891927004 CET	49731	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:00.892532110 CET	49731	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:01.133577108 CET	19354	49731	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:01.133658886 CET	49731	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:01.235593081 CET	19354	49731	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:01.287942886 CET	49731	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:01.374927044 CET	19354	49731	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:01.407370090 CET	19354	49731	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:01.407386065 CET	19354	49731	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:01.407542944 CET	49731	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:03.241113901 CET	49731	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:03.242218018 CET	49732	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:03.484025955 CET	19354	49732	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:03.484100103 CET	49732	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:03.485136032 CET	49732	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:03.726814985 CET	19354	49732	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:03.726886988 CET	49732	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:03.814831018 CET	19354	49732	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:03.866045952 CET	49732	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:03.968732119 CET	19354	49732	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:03.999703884 CET	19354	49732	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:03.999720097 CET	19354	49732	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:03.999783993 CET	49732	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:05.840255022 CET	49732	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:05.841445923 CET	49733	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:06.081151009 CET	19354	49733	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:06.081355095 CET	49733	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:06.081901073 CET	49733	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:06.321582079 CET	19354	49733	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:06.321692944 CET	49733	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:06.409636021 CET	19354	49733	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:06.561436892 CET	19354	49733	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:06.569060087 CET	49733	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:06.594801903 CET	19354	49733	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:06.594818115 CET	19354	49733	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:06.594871998 CET	49733	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:08.413548946 CET	49733	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:08.421092033 CET	49735	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:08.661777973 CET	19354	49735	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:08.661849022 CET	49735	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:08.663103104 CET	49735	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:08.903800964 CET	19354	49735	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:08.903912067 CET	49735	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:09.012130022 CET	19354	49735	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:09.144530058 CET	19354	49735	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:09.170716047 CET	19354	49735	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:09.170902967 CET	49735	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:09.171422005 CET	19354	49735	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:09.171493053 CET	49735	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:11.022619963 CET	49735	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:11.023657084 CET	49741	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:11.266801119 CET	19354	49741	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:11.267137051 CET	49741	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:11.270021915 CET	49741	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:11.513315916 CET	19354	49741	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:11.514601946 CET	49741	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:11.594841003 CET	19354	49741	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:11.662825108 CET	49741	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:11.757683039 CET	19354	49741	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:11.785778046 CET	19354	49741	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:11.785835028 CET	19354	49741	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:11.785921097 CET	49741	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:13.600963116 CET	49741	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:13.605890989 CET	49742	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:13.846651077 CET	19354	49742	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:13.846934080 CET	49742	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:13.847950935 CET	49742	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:14.088594913 CET	19354	49742	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:14.088663101 CET	49742	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:14.181797981 CET	19354	49742	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:14.272203922 CET	49742	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:14.329301119 CET	19354	49742	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:14.359915018 CET	19354	49742	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:14.360059977 CET	19354	49742	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:14.360112906 CET	49742	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:16.194334984 CET	49742	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:16.195732117 CET	49743	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:16.441185951 CET	19354	49743	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:16.441327095 CET	49743	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:16.443459034 CET	49743	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:16.688981056 CET	19354	49743	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:16.689114094 CET	49743	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:16.797094107 CET	19354	49743	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:16.850425959 CET	49743	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:16.934520960 CET	19354	49743	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:16.965940952 CET	19354	49743	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:16.974797964 CET	19354	49743	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:16.974967957 CET	49743	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:18.803529978 CET	49743	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:18.804729939 CET	49744	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:19.049343109 CET	19354	49744	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:19.049530029 CET	49744	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:19.050040960 CET	49744	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:19.294501066 CET	19354	49744	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:19.294692039 CET	49744	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:19.392755032 CET	19354	49744	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:19.444128990 CET	49744	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:19.539094925 CET	19354	49744	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:19.573976040 CET	19354	49744	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:19.573988914 CET	19354	49744	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:19.574048996 CET	49744	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:21.397290945 CET	49744	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:21.398519993 CET	49745	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:21.640994072 CET	19354	49745	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:21.641103029 CET	49745	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:21.641720057 CET	49745	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:21.884291887 CET	19354	49745	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:21.884586096 CET	49745	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:22.005055904 CET	19354	49745	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:22.069222927 CET	49745	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:22.127147913 CET	19354	49745	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:22.155880928 CET	19354	49745	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:22.155936003 CET	19354	49745	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:22.156177998 CET	49745	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:24.061997890 CET	49745	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:24.080318928 CET	49746	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:24.323915005 CET	19354	49746	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:24.324049950 CET	49746	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:24.324942112 CET	49746	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:24.568738937 CET	19354	49746	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:24.568831921 CET	49746	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:24.652942896 CET	19354	49746	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:24.739059925 CET	49746	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:24.812693119 CET	19354	49746	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:24.838845968 CET	19354	49746	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:24.852193117 CET	19354	49746	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:24.852261066 CET	49746	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:26.663192034 CET	49746	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:26.666383028 CET	49747	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:26.908193111 CET	19354	49747	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:26.908567905 CET	49747	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:26.909122944 CET	49747	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:27.150551081 CET	19354	49747	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:27.150655031 CET	49747	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:27.233905077 CET	19354	49747	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:27.233978987 CET	49747	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:27.392143011 CET	19354	49747	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:27.423588037 CET	19354	49747	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:27.423638105 CET	19354	49747	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:27.423718929 CET	49747	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:27.475579977 CET	19354	49747	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:27.665219069 CET	19354	49747	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:29.269331932 CET	49748	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:29.509983063 CET	19354	49748	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:29.510155916 CET	49748	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:29.511857033 CET	49748	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:29.752959013 CET	19354	49748	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:29.753082037 CET	49748	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:29.858458996 CET	19354	49748	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:29.993510008 CET	19354	49748	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:30.022701979 CET	19354	49748	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:30.022735119 CET	19354	49748	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:30.022757053 CET	49748	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:30.022804976 CET	49748	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:31.866151094 CET	49748	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:31.867369890 CET	49749	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:32.110030890 CET	19354	49749	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:32.110120058 CET	49749	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:32.111036062 CET	49749	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:32.353615999 CET	19354	49749	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:32.353859901 CET	49749	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:32.436157942 CET	19354	49749	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:32.490957975 CET	49749	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:32.608221054 CET	19354	49749	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:32.624315023 CET	19354	49749	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:32.624331951 CET	19354	49749	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:32.624413967 CET	49749	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:34.444252968 CET	49749	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:34.445239067 CET	49750	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:34.687108040 CET	19354	49750	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:34.687323093 CET	49750	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:34.687733889 CET	49750	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:34.929590940 CET	19354	49750	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:34.929637909 CET	49750	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:35.032809019 CET	19354	49750	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:35.084790945 CET	49750	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:35.171435118 CET	19354	49750	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:35.201462984 CET	19354	49750	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:35.201478958 CET	19354	49750	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:35.201652050 CET	49750	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:37.037993908 CET	49750	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:37.039066076 CET	49751	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:37.278801918 CET	19354	49751	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:37.279035091 CET	49751	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:37.279473066 CET	49751	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:37.519175053 CET	19354	49751	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:37.519222975 CET	49751	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:37.604433060 CET	19354	49751	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:37.647273064 CET	49751	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:37.758863926 CET	19354	49751	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:37.787389994 CET	19354	49751	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:37.787451029 CET	19354	49751	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:37.787514925 CET	49751	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:39.475552082 CET	49751	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:39.484791040 CET	49752	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:39.725323915 CET	19354	49752	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:39.725442886 CET	49752	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:39.791208029 CET	49752	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:39.966010094 CET	19354	49752	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:39.966123104 CET	49752	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:39.966161013 CET	19354	49752	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:39.966211081 CET	49752	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:40.031846046 CET	19354	49752	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:40.206614017 CET	19354	49752	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:40.206629038 CET	19354	49752	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:41.710866928 CET	49753	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:41.950124979 CET	19354	49753	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:41.950222969 CET	49753	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:41.950784922 CET	49753	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:42.189599991 CET	19354	49753	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:42.189749956 CET	19354	49753	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:42.189826965 CET	49753	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:42.189826965 CET	49753	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:42.189971924 CET	19354	49753	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:42.429240942 CET	19354	49753	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:42.429254055 CET	19354	49753	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:43.831419945 CET	49754	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:44.073935986 CET	19354	49754	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:44.074026108 CET	49754	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:44.074834108 CET	49754	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:44.316701889 CET	19354	49754	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:44.316716909 CET	19354	49754	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:44.316817999 CET	49754	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:44.317152977 CET	19354	49754	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:44.559246063 CET	19354	49754	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:45.885195971 CET	49755	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:46.128730059 CET	19354	49755	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:46.128828049 CET	49755	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:46.129319906 CET	49755	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:46.372411966 CET	19354	49755	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:46.372576952 CET	19354	49755	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:46.372600079 CET	49755	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:46.372653961 CET	49755	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:46.372809887 CET	19354	49755	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:46.615991116 CET	19354	49755	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:46.616020918 CET	19354	49755	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:47.806771040 CET	49756	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:48.049669981 CET	19354	49756	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:48.049787045 CET	49756	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:48.050571918 CET	49756	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:48.292825937 CET	19354	49756	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:48.292840004 CET	19354	49756	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:48.292898893 CET	49756	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:48.293452024 CET	19354	49756	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:48.535660982 CET	19354	49756	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:49.634615898 CET	49757	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:49.874525070 CET	19354	49757	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:49.874598980 CET	49757	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:49.875086069 CET	49757	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:50.114594936 CET	19354	49757	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:50.114636898 CET	19354	49757	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:50.114659071 CET	49757	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:50.114698887 CET	49757	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:50.114908934 CET	19354	49757	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:50.354707956 CET	19354	49757	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:50.354873896 CET	19354	49757	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:51.356833935 CET	49759	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:51.597254038 CET	19354	49759	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:51.599073887 CET	49759	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:51.599816084 CET	49759	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:51.839597940 CET	19354	49759	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:51.839616060 CET	19354	49759	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:51.839689016 CET	49759	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:51.840080023 CET	19354	49759	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:52.080039978 CET	19354	49759	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:53.008819103 CET	49760	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:53.251128912 CET	19354	49760	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:53.251445055 CET	49760	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:53.252163887 CET	49760	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:53.493859053 CET	19354	49760	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:53.493877888 CET	19354	49760	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:53.493963957 CET	49760	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:53.494110107 CET	49760	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:53.494343996 CET	19354	49760	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:53.736330032 CET	19354	49760	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:53.736406088 CET	19354	49760	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:54.586138964 CET	49761	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:54.827773094 CET	19354	49761	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:54.827852011 CET	49761	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:54.828622103 CET	49761	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:55.069709063 CET	19354	49761	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:55.069722891 CET	19354	49761	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:55.069797993 CET	49761	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:57:55.070066929 CET	19354	49761	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:55.311407089 CET	19354	49761	3.127.138.57	192.168.2.4
Dec 30, 2023 06:57:56.298998117 CET	49762	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:56.539036989 CET	19354	49762	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:56.539139986 CET	49762	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:56.539963007 CET	49762	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:56.779381990 CET	19354	49762	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:56.779398918 CET	19354	49762	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:56.779495955 CET	49762	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:56.779906988 CET	19354	49762	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:57.019632101 CET	19354	49762	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:58.310801029 CET	49763	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:58.550436974 CET	19354	49763	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:58.550637960 CET	49763	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:58.658795118 CET	49763	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:58.790417910 CET	19354	49763	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:58.790433884 CET	19354	49763	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:58.790672064 CET	49763	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:58.898622990 CET	19354	49763	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:59.030297995 CET	19354	49763	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:59.686278105 CET	49764	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:59.929301977 CET	19354	49764	18.156.13.209	192.168.2.4
Dec 30, 2023 06:57:59.929392099 CET	49764	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:57:59.930347919 CET	49764	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:00.172513008 CET	19354	49764	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:00.172621965 CET	49764	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:00.172861099 CET	19354	49764	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:00.172991037 CET	49764	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:00.173341990 CET	19354	49764	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:00.415615082 CET	19354	49764	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:00.415857077 CET	19354	49764	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:00.992511034 CET	49765	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:01.232672930 CET	19354	49765	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:01.232888937 CET	49765	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:01.233628035 CET	49765	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:01.473098993 CET	19354	49765	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:01.473112106 CET	19354	49765	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:01.473264933 CET	49765	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:01.473514080 CET	19354	49765	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:01.713239908 CET	19354	49765	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:02.242513895 CET	49766	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:02.484847069 CET	19354	49766	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:02.484931946 CET	49766	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:02.485766888 CET	49766	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:02.727041006 CET	19354	49766	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:02.727061033 CET	19354	49766	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:02.727133036 CET	49766	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:02.727567911 CET	19354	49766	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:02.968995094 CET	19354	49766	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:03.466685057 CET	49767	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:03.712558985 CET	19354	49767	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:03.712667942 CET	49767	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:03.713666916 CET	49767	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:03.958637953 CET	19354	49767	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:03.958652973 CET	19354	49767	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:03.958714962 CET	49767	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:03.958750010 CET	49767	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:03.959395885 CET	19354	49767	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:04.204499960 CET	19354	49767	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:04.204637051 CET	19354	49767	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:04.633238077 CET	49768	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:04.875629902 CET	19354	49768	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:04.875732899 CET	49768	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:04.876943111 CET	49768	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:05.118236065 CET	19354	49768	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:05.118249893 CET	19354	49768	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:05.118313074 CET	49768	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:05.118354082 CET	49768	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:05.119173050 CET	19354	49768	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:05.360723972 CET	19354	49768	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:05.360738993 CET	19354	49768	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:05.743041992 CET	49769	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:05.986917019 CET	19354	49769	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:05.987031937 CET	49769	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:05.987999916 CET	49769	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:06.230175018 CET	19354	49769	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:06.230189085 CET	19354	49769	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:06.230283022 CET	49769	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:06.230813980 CET	19354	49769	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:06.473305941 CET	19354	49769	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:06.826179028 CET	49770	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:07.066178083 CET	19354	49770	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:07.066287041 CET	49770	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:07.067338943 CET	49770	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:07.306039095 CET	19354	49770	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:07.306056023 CET	19354	49770	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:07.306224108 CET	49770	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:07.306224108 CET	49770	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:07.306979895 CET	19354	49770	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:07.546003103 CET	19354	49770	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:07.546015978 CET	19354	49770	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:07.856683016 CET	49771	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:08.095185041 CET	19354	49771	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:08.095284939 CET	49771	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:08.096307993 CET	49771	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:08.334018946 CET	19354	49771	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:08.334032059 CET	19354	49771	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:08.334196091 CET	49771	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:08.334676027 CET	19354	49771	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:08.572686911 CET	19354	49771	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:08.852111101 CET	49772	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:09.094588995 CET	19354	49772	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:09.094680071 CET	49772	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:09.095731020 CET	49772	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:09.337173939 CET	19354	49772	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:09.337203026 CET	19354	49772	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:09.337275982 CET	49772	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:09.337819099 CET	19354	49772	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:09.579693079 CET	19354	49772	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:09.820400953 CET	49773	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:10.060245991 CET	19354	49773	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:10.060367107 CET	49773	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:10.061343908 CET	49773	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:10.300115108 CET	19354	49773	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:10.300117016 CET	19354	49773	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:10.300190926 CET	49773	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:10.300797939 CET	19354	49773	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:10.539756060 CET	19354	49773	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:10.742480040 CET	49774	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:10.979680061 CET	19354	49774	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:10.979772091 CET	49774	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:10.980763912 CET	49774	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:11.216897011 CET	19354	49774	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:11.216931105 CET	19354	49774	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:11.217163086 CET	49774	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:11.217597961 CET	19354	49774	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:11.454109907 CET	19354	49774	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:11.655291080 CET	49775	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:11.897640944 CET	19354	49775	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:11.897865057 CET	49775	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:11.898803949 CET	49775	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:12.140439034 CET	19354	49775	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:12.140475988 CET	19354	49775	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:12.140544891 CET	49775	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:12.140566111 CET	49775	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:12.141031027 CET	19354	49775	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:12.383076906 CET	19354	49775	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:12.383104086 CET	19354	49775	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:12.539172888 CET	49776	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:12.778510094 CET	19354	49776	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:12.778629065 CET	49776	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:12.779493093 CET	49776	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:13.018224001 CET	19354	49776	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:13.018254995 CET	19354	49776	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:13.018301010 CET	49776	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:13.018321037 CET	49776	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:13.018587112 CET	19354	49776	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:13.259902000 CET	19354	49776	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:13.259913921 CET	19354	49776	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:13.382709980 CET	49777	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:13.627516985 CET	19354	49777	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:13.627597094 CET	49777	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:13.628185987 CET	49777	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:13.872520924 CET	19354	49777	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:13.872553110 CET	19354	49777	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:13.872631073 CET	49777	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:13.872889042 CET	19354	49777	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:14.117446899 CET	19354	49777	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:14.210779905 CET	49778	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:14.449465990 CET	19354	49778	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:14.449559927 CET	49778	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:14.453525066 CET	49778	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:14.688656092 CET	19354	49778	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:14.688671112 CET	19354	49778	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:14.688766956 CET	49778	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:14.692053080 CET	19354	49778	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:14.927287102 CET	19354	49778	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:15.307110071 CET	49779	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:15.549776077 CET	19354	49779	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:15.549916983 CET	49779	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:15.550530910 CET	49779	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:15.792695999 CET	19354	49779	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:15.792812109 CET	49779	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:15.792849064 CET	19354	49779	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:15.792920113 CET	49779	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:15.793061972 CET	19354	49779	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:16.036072969 CET	19354	49779	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:16.036108971 CET	19354	49779	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:16.597455025 CET	49780	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:16.839514971 CET	19354	49780	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:16.839610100 CET	49780	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:16.840241909 CET	49780	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:17.081511974 CET	19354	49780	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:17.081541061 CET	19354	49780	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:17.081603050 CET	49780	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:17.081620932 CET	49780	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:17.081878901 CET	19354	49780	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:17.323290110 CET	19354	49780	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:17.323319912 CET	19354	49780	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:17.367172003 CET	49781	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:17.604918003 CET	19354	49781	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:17.605129957 CET	49781	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:17.605536938 CET	49781	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:17.843152046 CET	19354	49781	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:17.843184948 CET	19354	49781	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:17.843194962 CET	19354	49781	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:17.843270063 CET	49781	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:18.081218004 CET	19354	49781	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:18.101429939 CET	49782	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:18.344285965 CET	19354	49782	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:18.344388008 CET	49782	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:18.344993114 CET	49782	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:18.587568045 CET	19354	49782	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:18.587634087 CET	19354	49782	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:18.587635994 CET	49782	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:18.587661982 CET	19354	49782	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:18.587680101 CET	49782	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:18.830452919 CET	19354	49782	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:18.830496073 CET	19354	49782	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:18.835980892 CET	49783	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:19.075556993 CET	19354	49783	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:19.075786114 CET	49783	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:19.076237917 CET	49783	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:19.316078901 CET	19354	49783	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:19.316106081 CET	19354	49783	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:19.316112041 CET	19354	49783	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:19.316332102 CET	49783	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:19.550966978 CET	49783	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:19.552352905 CET	49784	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:19.555958033 CET	19354	49783	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:19.797579050 CET	19354	49784	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:19.803090096 CET	49784	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:19.803731918 CET	49784	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:20.048382998 CET	19354	49784	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:20.048420906 CET	19354	49784	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:20.048612118 CET	49784	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:20.048707008 CET	19354	49784	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:20.256684065 CET	49784	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:20.257739067 CET	49785	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:20.293905020 CET	19354	49784	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:20.502135038 CET	19354	49785	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:20.502245903 CET	49785	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:20.502866983 CET	49785	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:20.746783018 CET	19354	49785	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:20.746798992 CET	19354	49785	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:20.746862888 CET	49785	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:20.746997118 CET	19354	49785	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:20.944242001 CET	49785	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:20.945406914 CET	49786	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:20.991242886 CET	19354	49785	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:21.187278986 CET	19354	49786	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:21.189857960 CET	49786	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:21.190682888 CET	49786	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:21.431865931 CET	19354	49786	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:21.431894064 CET	19354	49786	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:21.432065010 CET	49786	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:21.432614088 CET	19354	49786	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:21.616522074 CET	49786	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:21.617552042 CET	49787	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:21.673980951 CET	19354	49786	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:21.858721972 CET	19354	49787	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:21.858798981 CET	49787	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:21.859503031 CET	49787	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:22.099843979 CET	19354	49787	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:22.099862099 CET	19354	49787	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:22.099906921 CET	49787	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:22.099948883 CET	49787	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:22.100285053 CET	19354	49787	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:22.272299051 CET	49787	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:22.273454905 CET	49788	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:22.340893030 CET	19354	49787	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:22.340913057 CET	19354	49787	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:22.516402006 CET	19354	49788	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:22.516474962 CET	49788	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:22.517327070 CET	49788	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:22.759617090 CET	19354	49788	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:22.759649038 CET	19354	49788	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:22.759732008 CET	49788	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:22.760241985 CET	19354	49788	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:22.928529978 CET	49788	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:22.929572105 CET	49789	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:23.002851963 CET	19354	49788	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:23.168359041 CET	19354	49789	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:23.168443918 CET	49789	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:23.169790983 CET	49789	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:23.407259941 CET	19354	49789	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:23.407274961 CET	19354	49789	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:23.407334089 CET	49789	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:23.408323050 CET	19354	49789	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:23.553642035 CET	49789	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:23.554681063 CET	49790	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:23.646004915 CET	19354	49789	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:23.797100067 CET	19354	49790	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:23.797205925 CET	49790	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:23.797822952 CET	49790	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.039774895 CET	19354	49790	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.039791107 CET	19354	49790	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.039838076 CET	49790	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.039882898 CET	49790	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.039902925 CET	19354	49790	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.178569078 CET	49790	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.179522991 CET	49791	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.282085896 CET	19354	49790	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.282099962 CET	19354	49790	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.421844006 CET	19354	49791	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.421943903 CET	49791	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.422555923 CET	49791	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.664598942 CET	19354	49791	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.664618969 CET	19354	49791	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.664665937 CET	49791	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.664705992 CET	49791	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.664767981 CET	19354	49791	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.803643942 CET	49791	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.804748058 CET	49792	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:24.907155037 CET	19354	49791	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:24.907167912 CET	19354	49791	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:25.048531055 CET	19354	49792	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:25.048612118 CET	49792	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:25.052320004 CET	49792	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:25.292591095 CET	19354	49792	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:25.292603970 CET	19354	49792	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:25.292660952 CET	49792	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:25.295943022 CET	19354	49792	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:25.430929899 CET	49792	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:25.432034016 CET	49793	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:25.536312103 CET	19354	49792	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:25.673746109 CET	19354	49793	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:25.673851013 CET	49793	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:25.674401045 CET	49793	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:25.915761948 CET	19354	49793	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:25.915790081 CET	19354	49793	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:25.915868998 CET	49793	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:25.916273117 CET	19354	49793	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:26.037954092 CET	49793	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:26.040007114 CET	49794	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:26.157805920 CET	19354	49793	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:26.282926083 CET	19354	49794	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:26.283005953 CET	49794	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:26.283658981 CET	49794	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:26.526029110 CET	19354	49794	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:26.526047945 CET	19354	49794	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:26.526084900 CET	49794	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:26.526113033 CET	49794	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:26.526457071 CET	19354	49794	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:26.631653070 CET	49794	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:26.632620096 CET	49795	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:26.769078970 CET	19354	49794	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:26.769089937 CET	19354	49794	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:26.876574993 CET	19354	49795	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:26.876708984 CET	49795	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:26.878298044 CET	49795	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.120683908 CET	19354	49795	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:27.120711088 CET	19354	49795	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:27.120834112 CET	49795	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.122190952 CET	19354	49795	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:27.225418091 CET	49795	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.226392984 CET	49796	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.364667892 CET	19354	49795	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:27.468835115 CET	19354	49796	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:27.468950987 CET	49796	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.470586061 CET	49796	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.711349964 CET	19354	49796	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:27.711380005 CET	19354	49796	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:27.711457014 CET	49796	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.711477041 CET	49796	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.712718010 CET	19354	49796	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:27.803529024 CET	49796	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.804554939 CET	49797	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:27.953979969 CET	19354	49796	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:27.953991890 CET	19354	49796	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.046653986 CET	19354	49797	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.046778917 CET	49797	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.048530102 CET	49797	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.289083004 CET	19354	49797	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.289117098 CET	19354	49797	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.289196014 CET	49797	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.289232969 CET	49797	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.290546894 CET	19354	49797	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.381668091 CET	49797	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.382591009 CET	49798	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.531244993 CET	19354	49797	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.531276941 CET	19354	49797	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.628097057 CET	19354	49798	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.628212929 CET	49798	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.628829956 CET	49798	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.873769045 CET	19354	49798	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.873806000 CET	19354	49798	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.873868942 CET	49798	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.873904943 CET	49798	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.874051094 CET	19354	49798	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:28.960310936 CET	49798	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:28.974420071 CET	49799	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:29.119342089 CET	19354	49798	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:29.119369984 CET	19354	49798	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:29.211638927 CET	19354	49799	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:29.211745977 CET	49799	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:29.212613106 CET	49799	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:29.449337006 CET	19354	49799	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:29.449385881 CET	19354	49799	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:29.449481964 CET	49799	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:29.449696064 CET	19354	49799	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:29.449733019 CET	49799	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:29.538038015 CET	49799	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:29.539139986 CET	49800	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:29.686760902 CET	19354	49799	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:29.686808109 CET	19354	49799	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:29.780451059 CET	19354	49800	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:29.780654907 CET	49800	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:29.782591105 CET	49800	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.021934032 CET	19354	49800	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.021948099 CET	19354	49800	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.022010088 CET	49800	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.023519039 CET	19354	49800	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.100474119 CET	49800	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.101500034 CET	49801	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.263041973 CET	19354	49800	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.342762947 CET	19354	49801	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.342885017 CET	49801	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.343482971 CET	49801	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.584295988 CET	19354	49801	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.584330082 CET	19354	49801	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.584405899 CET	49801	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.584635019 CET	49801	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.584881067 CET	19354	49801	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.662919044 CET	49801	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.664108038 CET	49802	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.825658083 CET	19354	49801	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.825742006 CET	19354	49801	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.905564070 CET	19354	49802	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:30.905781031 CET	49802	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:30.906255960 CET	49802	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.147478104 CET	19354	49802	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:31.147480011 CET	19354	49802	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:31.147530079 CET	19354	49802	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:31.147559881 CET	49802	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.220212936 CET	49802	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.221117020 CET	49803	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.389095068 CET	19354	49802	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:31.464378119 CET	19354	49803	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:31.464520931 CET	49803	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.468455076 CET	49803	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.707746029 CET	19354	49803	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:31.707776070 CET	19354	49803	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:31.707861900 CET	49803	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.707895994 CET	49803	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.711489916 CET	19354	49803	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:31.772326946 CET	49803	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.773396969 CET	49804	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:31.951678991 CET	19354	49803	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:31.951689959 CET	19354	49803	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.015662909 CET	19354	49804	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.015746117 CET	49804	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.016402006 CET	49804	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.258167028 CET	19354	49804	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.258177996 CET	19354	49804	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.258279085 CET	49804	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.258677959 CET	19354	49804	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.319166899 CET	49804	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.320183992 CET	49805	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.500633001 CET	19354	49804	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.562853098 CET	19354	49805	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.562922001 CET	49805	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.563529968 CET	49805	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.805737019 CET	19354	49805	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.805768013 CET	19354	49805	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.805845022 CET	49805	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.805845976 CET	49805	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.805881977 CET	19354	49805	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:32.866051912 CET	49805	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:32.867043972 CET	49806	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:33.048394918 CET	19354	49805	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.048408985 CET	19354	49805	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.111119032 CET	19354	49806	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.111248970 CET	49806	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:33.167162895 CET	49806	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:33.355370045 CET	19354	49806	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.355400085 CET	19354	49806	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.355459929 CET	49806	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:33.411066055 CET	19354	49806	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.412931919 CET	49806	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:33.414015055 CET	49807	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:33.599477053 CET	19354	49806	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.653493881 CET	19354	49807	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.653589010 CET	49807	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:33.893107891 CET	19354	49807	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.893135071 CET	19354	49807	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:33.893208981 CET	49807	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.079878092 CET	49807	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.131653070 CET	49807	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.132632971 CET	49808	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.319220066 CET	19354	49807	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:34.378563881 CET	19354	49808	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:34.378798008 CET	49808	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.389035940 CET	49808	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.624906063 CET	19354	49808	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:34.624936104 CET	19354	49808	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:34.624993086 CET	49808	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.625010014 CET	49808	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.634984016 CET	19354	49808	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:34.764055967 CET	49808	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.765091896 CET	49809	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:34.870866060 CET	19354	49808	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:34.870915890 CET	19354	49808	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.007375002 CET	19354	49809	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.007458925 CET	49809	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.007967949 CET	49809	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.249974966 CET	19354	49809	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.250008106 CET	19354	49809	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.250061035 CET	49809	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.250107050 CET	49809	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.250170946 CET	19354	49809	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.288853884 CET	49809	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.289756060 CET	49810	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.492583990 CET	19354	49809	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.492613077 CET	19354	49809	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.529040098 CET	19354	49810	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.529248953 CET	49810	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.529676914 CET	49810	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.769632101 CET	19354	49810	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.769644976 CET	19354	49810	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.769711971 CET	49810	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.769892931 CET	19354	49810	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:35.819185972 CET	49810	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:35.820188046 CET	49811	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.008879900 CET	19354	49810	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.061103106 CET	19354	49811	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.061211109 CET	49811	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.061798096 CET	49811	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.302227974 CET	19354	49811	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.302287102 CET	49811	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.302578926 CET	19354	49811	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.302588940 CET	19354	49811	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.302632093 CET	49811	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.350667953 CET	49811	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.351701021 CET	49812	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.543267965 CET	19354	49811	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.543395042 CET	19354	49811	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.593422890 CET	19354	49812	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.593492031 CET	49812	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.594043970 CET	49812	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.835263968 CET	19354	49812	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.835455894 CET	49812	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.835475922 CET	19354	49812	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.835524082 CET	49812	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.835604906 CET	19354	49812	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:36.866033077 CET	49812	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:36.867039919 CET	49813	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.077826023 CET	19354	49812	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.077853918 CET	19354	49812	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.110816002 CET	19354	49813	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.110877037 CET	49813	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.111512899 CET	49813	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.354887962 CET	19354	49813	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.354949951 CET	49813	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.355366945 CET	19354	49813	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.355376959 CET	19354	49813	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.355418921 CET	49813	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.397600889 CET	49813	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.404426098 CET	49814	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.598769903 CET	19354	49813	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.599061012 CET	19354	49813	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.645752907 CET	19354	49814	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.645883083 CET	49814	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.646708965 CET	49814	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.887207985 CET	19354	49814	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.887236118 CET	19354	49814	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.887300968 CET	49814	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.887835026 CET	19354	49814	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:37.929512978 CET	49814	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:37.938266039 CET	49815	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.128437042 CET	19354	49814	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.180172920 CET	19354	49815	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.180330038 CET	49815	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.185220003 CET	49815	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.422117949 CET	19354	49815	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.422144890 CET	19354	49815	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.422230005 CET	49815	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.426739931 CET	19354	49815	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.459767103 CET	49815	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.460742950 CET	49816	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.664048910 CET	19354	49815	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.706485033 CET	19354	49816	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.706610918 CET	49816	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.707245111 CET	49816	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.952754974 CET	19354	49816	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.952781916 CET	19354	49816	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.952892065 CET	49816	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.953598976 CET	19354	49816	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:38.991147041 CET	49816	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:38.992177010 CET	49817	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.198976040 CET	19354	49816	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.232516050 CET	19354	49817	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.232764006 CET	49817	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.233275890 CET	49817	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.473288059 CET	19354	49817	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.473534107 CET	49817	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.473542929 CET	19354	49817	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.473556042 CET	19354	49817	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.473592997 CET	49817	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.509887934 CET	49817	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.510932922 CET	49818	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.713917017 CET	19354	49817	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.713929892 CET	19354	49817	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.749478102 CET	19354	49818	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.749607086 CET	49818	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.751348972 CET	49818	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.988311052 CET	19354	49818	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.988344908 CET	19354	49818	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:39.988518000 CET	49818	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.988518953 CET	49818	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:39.989804983 CET	19354	49818	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.022301912 CET	49818	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:40.023286104 CET	49819	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:40.227093935 CET	19354	49818	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.227107048 CET	19354	49818	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.262006998 CET	19354	49819	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.262073994 CET	49819	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:40.262690067 CET	49819	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:40.500937939 CET	19354	49819	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.500952005 CET	19354	49819	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.500999928 CET	49819	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:40.501013041 CET	49819	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:40.501234055 CET	19354	49819	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.522279024 CET	49819	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:40.523272991 CET	49820	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:40.739631891 CET	19354	49819	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.739645004 CET	19354	49819	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.764806986 CET	19354	49820	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:40.764899015 CET	49820	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:40.765520096 CET	49820	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.006557941 CET	19354	49820	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.006653070 CET	49820	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.006706953 CET	19354	49820	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.006773949 CET	49820	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.007035017 CET	19354	49820	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.038014889 CET	49820	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.039110899 CET	49821	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.248321056 CET	19354	49820	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.248333931 CET	19354	49820	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.278459072 CET	19354	49821	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.278547049 CET	49821	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.279187918 CET	49821	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.517972946 CET	19354	49821	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.518023014 CET	49821	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.518126011 CET	19354	49821	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.518172026 CET	49821	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.518274069 CET	19354	49821	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.586462021 CET	49821	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.587506056 CET	49822	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.757452965 CET	19354	49821	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.757464886 CET	19354	49821	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.833708048 CET	19354	49822	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:41.833811045 CET	49822	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:41.834391117 CET	49822	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.079993963 CET	19354	49822	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.080008984 CET	19354	49822	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.080105066 CET	49822	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.080341101 CET	19354	49822	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.100537062 CET	49822	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.101499081 CET	49823	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.326153994 CET	19354	49822	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.340836048 CET	19354	49823	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.340910912 CET	49823	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.341538906 CET	49823	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.580466986 CET	19354	49823	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.580480099 CET	19354	49823	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.580545902 CET	49823	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.580807924 CET	19354	49823	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.603815079 CET	49823	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.604780912 CET	49824	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.819755077 CET	19354	49823	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.847682953 CET	19354	49824	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:42.847779989 CET	49824	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:42.848388910 CET	49824	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.090810061 CET	19354	49824	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.090827942 CET	19354	49824	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.090902090 CET	49824	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.091136932 CET	19354	49824	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.116516113 CET	49824	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.117674112 CET	49825	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.333781958 CET	19354	49824	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.358016968 CET	19354	49825	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.358128071 CET	49825	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.358709097 CET	49825	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.598654985 CET	19354	49825	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.598669052 CET	19354	49825	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.598733902 CET	49825	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.598998070 CET	19354	49825	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.618050098 CET	49825	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.619998932 CET	49826	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.840214014 CET	19354	49825	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.860378027 CET	19354	49826	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:43.860469103 CET	49826	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:43.862219095 CET	49826	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.099289894 CET	19354	49826	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.099309921 CET	19354	49826	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.099384069 CET	49826	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.099415064 CET	49826	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.100776911 CET	19354	49826	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.116338968 CET	49826	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.123684883 CET	49827	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.337989092 CET	19354	49826	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.338217020 CET	19354	49826	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.367098093 CET	19354	49827	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.367202044 CET	49827	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.367836952 CET	49827	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.610699892 CET	19354	49827	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.610728979 CET	19354	49827	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.610807896 CET	49827	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.610972881 CET	19354	49827	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.631869078 CET	49827	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.639857054 CET	49828	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.854114056 CET	19354	49827	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.881496906 CET	19354	49828	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:44.881601095 CET	49828	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:44.882262945 CET	49828	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.123395920 CET	19354	49828	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.123409033 CET	19354	49828	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.123471975 CET	49828	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.123835087 CET	19354	49828	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.147468090 CET	49828	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.148526907 CET	49829	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.365080118 CET	19354	49828	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.389058113 CET	19354	49829	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.389152050 CET	49829	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.412489891 CET	49829	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.628849030 CET	19354	49829	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.628861904 CET	19354	49829	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.628952026 CET	49829	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.651055098 CET	49829	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.652029991 CET	19354	49829	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.652633905 CET	49830	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.868932009 CET	19354	49829	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.896928072 CET	19354	49830	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:45.897021055 CET	49830	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:45.902360916 CET	49830	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.139512062 CET	19354	49830	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.139525890 CET	19354	49830	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.139597893 CET	49830	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.144648075 CET	19354	49830	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.162935019 CET	49830	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.164000034 CET	49831	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.381970882 CET	19354	49830	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.407582045 CET	19354	49831	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.407702923 CET	49831	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.408297062 CET	49831	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.651432991 CET	19354	49831	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.651447058 CET	19354	49831	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.651530027 CET	49831	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.651721001 CET	19354	49831	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.662910938 CET	49831	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.663947105 CET	49832	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.895066023 CET	19354	49831	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.906238079 CET	19354	49832	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:46.906315088 CET	49832	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:46.906902075 CET	49832	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.148757935 CET	19354	49832	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.148855925 CET	49832	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.148911953 CET	19354	49832	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.149033070 CET	49832	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.149216890 CET	19354	49832	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.162978888 CET	49832	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.164016962 CET	49833	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.391478062 CET	19354	49832	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.391490936 CET	19354	49832	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.410056114 CET	19354	49833	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.410123110 CET	49833	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.410751104 CET	49833	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.656096935 CET	19354	49833	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.656114101 CET	19354	49833	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.656166077 CET	49833	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.656179905 CET	49833	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.656536102 CET	19354	49833	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.679135084 CET	49833	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.691179991 CET	49834	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.902100086 CET	19354	49833	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.902115107 CET	19354	49833	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.930996895 CET	19354	49834	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:47.931102991 CET	49834	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:47.933226109 CET	49834	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.171086073 CET	19354	49834	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.171099901 CET	19354	49834	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.171147108 CET	49834	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.172965050 CET	19354	49834	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.195456982 CET	49834	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.196516991 CET	49835	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.411072969 CET	19354	49834	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.441427946 CET	19354	49835	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.441541910 CET	49835	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.442152977 CET	49835	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.686575890 CET	19354	49835	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.686605930 CET	19354	49835	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.686723948 CET	49835	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.687217951 CET	19354	49835	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.694240093 CET	49835	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.695600986 CET	49836	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.931741953 CET	19354	49835	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.937390089 CET	19354	49836	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:48.937493086 CET	49836	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:48.938117027 CET	49836	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.179534912 CET	19354	49836	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.179564953 CET	19354	49836	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.179642916 CET	49836	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.180133104 CET	19354	49836	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.194241047 CET	49836	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.195348024 CET	49837	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.421494961 CET	19354	49836	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.437321901 CET	19354	49837	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.437392950 CET	49837	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.437993050 CET	49837	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.679553986 CET	19354	49837	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.679570913 CET	19354	49837	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.679622889 CET	49837	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.679651976 CET	49837	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.679913044 CET	19354	49837	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.694206953 CET	49837	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.695189953 CET	49838	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.921535015 CET	19354	49837	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.921547890 CET	19354	49837	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.934273958 CET	19354	49838	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:49.934492111 CET	49838	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:49.935179949 CET	49838	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:50.173677921 CET	19354	49838	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.173692942 CET	19354	49838	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.173808098 CET	49838	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:50.174057007 CET	19354	49838	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.202183962 CET	49838	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:50.203181028 CET	49839	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:50.412724972 CET	19354	49838	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.448662043 CET	19354	49839	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.448744059 CET	49839	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:50.449347973 CET	49839	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:50.694092989 CET	19354	49839	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.694124937 CET	19354	49839	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.694195986 CET	49839	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:50.694433928 CET	19354	49839	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.709846020 CET	49839	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:50.710866928 CET	49840	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:50.939620972 CET	19354	49839	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.954410076 CET	19354	49840	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:50.954520941 CET	49840	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:51.058203936 CET	49840	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:51.197916985 CET	19354	49840	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:51.198139906 CET	49840	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:51.198184967 CET	19354	49840	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:51.198230028 CET	49840	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:51.233712912 CET	49840	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:51.234798908 CET	49841	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:51.301484108 CET	19354	49840	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:51.441576004 CET	19354	49840	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:51.441611052 CET	19354	49840	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:51.477864981 CET	19354	49841	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:51.477967978 CET	49841	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:51.721400976 CET	19354	49841	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:51.721434116 CET	19354	49841	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:51.721534967 CET	49841	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:52.214515924 CET	49841	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:52.245666027 CET	49841	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:52.248600006 CET	49842	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:52.457748890 CET	19354	49841	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:52.490494967 CET	19354	49842	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:52.490613937 CET	49842	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:52.732789040 CET	19354	49842	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:52.732803106 CET	19354	49842	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:52.732884884 CET	49842	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:52.917768955 CET	49842	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:52.976128101 CET	49842	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:52.977045059 CET	49843	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.159737110 CET	19354	49842	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.217747927 CET	19354	49843	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.217942953 CET	49843	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.218383074 CET	49843	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.458527088 CET	19354	49843	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.458543062 CET	19354	49843	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.458642006 CET	49843	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.458784103 CET	19354	49843	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.475687981 CET	49843	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.476679087 CET	49844	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.699074984 CET	19354	49843	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.720247030 CET	19354	49844	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.720354080 CET	49844	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.721211910 CET	49844	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.964123964 CET	19354	49844	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.964139938 CET	19354	49844	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.964217901 CET	49844	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.964801073 CET	19354	49844	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:53.975641966 CET	49844	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:53.982872009 CET	49845	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.207890987 CET	19354	49844	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.222090960 CET	19354	49845	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.222152948 CET	49845	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.222789049 CET	49845	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.461831093 CET	19354	49845	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.461844921 CET	19354	49845	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.461893082 CET	49845	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.461913109 CET	49845	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.462018013 CET	19354	49845	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.476083994 CET	49845	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.477946997 CET	49846	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.701030970 CET	19354	49845	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.701071024 CET	19354	49845	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.720082998 CET	19354	49846	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.720187902 CET	49846	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.722012043 CET	49846	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.962855101 CET	19354	49846	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.962883949 CET	19354	49846	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.962969065 CET	49846	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.963007927 CET	49846	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.964071035 CET	19354	49846	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:54.975444078 CET	49846	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:54.976466894 CET	49847	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:55.205110073 CET	19354	49846	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:55.205123901 CET	19354	49846	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:55.219196081 CET	19354	49847	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:55.219316006 CET	49847	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:55.219908953 CET	49847	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:55.462378979 CET	19354	49847	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:55.462413073 CET	19354	49847	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:55.462476969 CET	49847	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:55.462512970 CET	49847	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:55.462620020 CET	19354	49847	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:55.475423098 CET	49847	19354	192.168.2.4	18.156.13.209
Dec 30, 2023 06:58:55.601169109 CET	49848	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:55.705246925 CET	19354	49847	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:55.705260038 CET	19354	49847	18.156.13.209	192.168.2.4
Dec 30, 2023 06:58:55.840503931 CET	19354	49848	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:55.840629101 CET	49848	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:55.841355085 CET	49848	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.079993010 CET	19354	49848	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.080007076 CET	19354	49848	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.080049992 CET	49848	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.080065012 CET	49848	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.080507040 CET	19354	49848	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.101556063 CET	49848	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.102540016 CET	49849	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.319482088 CET	19354	49848	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.319494963 CET	19354	49848	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.345535994 CET	19354	49849	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.345841885 CET	49849	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.346466064 CET	49849	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.589584112 CET	19354	49849	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.589692116 CET	49849	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.592210054 CET	19354	49849	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.592222929 CET	19354	49849	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.601435900 CET	49850	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.832658052 CET	19354	49849	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.842210054 CET	19354	49850	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:56.842308998 CET	49850	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:56.842955112 CET	49850	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.083234072 CET	19354	49850	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.083249092 CET	19354	49850	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.083342075 CET	49850	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.083647013 CET	19354	49850	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.100441933 CET	49850	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.105731010 CET	49851	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.324182034 CET	19354	49850	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.349494934 CET	19354	49851	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.349596024 CET	49851	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.350136042 CET	49851	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.593537092 CET	19354	49851	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.593550920 CET	19354	49851	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.593734980 CET	49851	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.593811989 CET	19354	49851	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.600425959 CET	49851	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.601495028 CET	49852	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.837544918 CET	19354	49851	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.839301109 CET	19354	49852	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:57.839375973 CET	49852	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:57.840226889 CET	49852	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.076363087 CET	19354	49852	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.076426029 CET	19354	49852	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.076572895 CET	49852	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.076908112 CET	19354	49852	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.084783077 CET	49852	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.085808992 CET	49853	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.313343048 CET	19354	49852	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.322787046 CET	19354	49853	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.322854042 CET	49853	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.326026917 CET	49853	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.559971094 CET	19354	49853	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.559983969 CET	19354	49853	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.560127974 CET	49853	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.562941074 CET	19354	49853	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.569856882 CET	49853	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.577073097 CET	49854	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.797218084 CET	19354	49853	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.817059994 CET	19354	49854	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:58.817277908 CET	49854	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:58.817854881 CET	49854	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.057389975 CET	19354	49854	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.057404041 CET	19354	49854	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.057473898 CET	49854	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.057501078 CET	49854	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.057763100 CET	19354	49854	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.069257975 CET	49854	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.070580006 CET	49855	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.297760963 CET	19354	49854	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.297771931 CET	19354	49854	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.315713882 CET	19354	49855	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.315831900 CET	49855	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.316698074 CET	49855	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.561113119 CET	19354	49855	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.561129093 CET	19354	49855	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.561214924 CET	49855	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.561248064 CET	49855	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.561738968 CET	19354	49855	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.595700026 CET	49855	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.596827984 CET	49856	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.806370020 CET	19354	49855	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.806384087 CET	19354	49855	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.842068911 CET	19354	49856	3.127.138.57	192.168.2.4
Dec 30, 2023 06:58:59.842209101 CET	49856	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:58:59.842820883 CET	49856	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.087599039 CET	19354	49856	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.087610960 CET	19354	49856	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.087694883 CET	49856	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.087739944 CET	19354	49856	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.100464106 CET	49856	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.101485968 CET	49857	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.332602978 CET	19354	49856	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.346801996 CET	19354	49857	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.346903086 CET	49857	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.347549915 CET	49857	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.592336893 CET	19354	49857	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.592351913 CET	19354	49857	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.592541933 CET	49857	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.592745066 CET	19354	49857	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.600569963 CET	49857	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.601628065 CET	49858	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.838017941 CET	19354	49857	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.843544960 CET	19354	49858	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:00.843638897 CET	49858	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:00.844263077 CET	49858	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.085702896 CET	19354	49858	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.085716963 CET	19354	49858	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.085902929 CET	49858	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.086318970 CET	19354	49858	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.100410938 CET	49858	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.101489067 CET	49859	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.327769041 CET	19354	49858	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.343554020 CET	19354	49859	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.343622923 CET	49859	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.345119953 CET	49859	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.585926056 CET	19354	49859	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.585939884 CET	19354	49859	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.585982084 CET	49859	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.586004972 CET	49859	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.587583065 CET	19354	49859	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.600455046 CET	49859	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.601461887 CET	49860	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.828130007 CET	19354	49859	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.828159094 CET	19354	49859	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.843187094 CET	19354	49860	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:01.843322039 CET	49860	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:01.845457077 CET	49860	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.085169077 CET	19354	49860	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.085182905 CET	19354	49860	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.085315943 CET	49860	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.087014914 CET	19354	49860	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.100492001 CET	49860	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.101583958 CET	49861	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.327120066 CET	19354	49860	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.342772007 CET	19354	49861	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.342987061 CET	49861	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.343732119 CET	49861	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.584198952 CET	19354	49861	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.584225893 CET	19354	49861	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.584434032 CET	49861	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.584613085 CET	19354	49861	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.600754023 CET	49861	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.601752043 CET	49862	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.825642109 CET	19354	49861	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.843916893 CET	19354	49862	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:02.844047070 CET	49862	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:02.844677925 CET	49862	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.086561918 CET	19354	49862	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.086584091 CET	19354	49862	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.086639881 CET	49862	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.086661100 CET	49862	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.086884975 CET	19354	49862	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.100452900 CET	49862	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.101730108 CET	49863	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.328772068 CET	19354	49862	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.328787088 CET	19354	49862	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.346587896 CET	19354	49863	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.346653938 CET	49863	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.347714901 CET	49863	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.591677904 CET	19354	49863	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.591691017 CET	19354	49863	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.591805935 CET	49863	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.592495918 CET	19354	49863	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.600438118 CET	49863	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.601615906 CET	49864	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.836857080 CET	19354	49863	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.843678951 CET	19354	49864	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:03.843791962 CET	49864	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:03.844409943 CET	49864	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.085916996 CET	19354	49864	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.086040020 CET	49864	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.086065054 CET	19354	49864	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.086116076 CET	49864	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.086286068 CET	19354	49864	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.100996017 CET	49864	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.102850914 CET	49865	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.328171968 CET	19354	49864	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.328486919 CET	19354	49864	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.345488071 CET	19354	49865	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.345555067 CET	49865	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.346122980 CET	49865	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.588386059 CET	19354	49865	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.588404894 CET	19354	49865	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.588452101 CET	49865	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.588502884 CET	49865	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.588675976 CET	19354	49865	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.600413084 CET	49865	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.601654053 CET	49866	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.831231117 CET	19354	49865	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.831243992 CET	19354	49865	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.844208002 CET	19354	49866	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:04.844307899 CET	49866	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:04.846811056 CET	49866	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.087012053 CET	19354	49866	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.087024927 CET	19354	49866	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.087575912 CET	49866	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.089574099 CET	19354	49866	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.100851059 CET	49866	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.157993078 CET	49867	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.330287933 CET	19354	49866	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.402930021 CET	19354	49867	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.403013945 CET	49867	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.403703928 CET	49867	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.648044109 CET	19354	49867	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.648058891 CET	19354	49867	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.648159981 CET	49867	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.648427963 CET	19354	49867	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.662952900 CET	49867	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.663965940 CET	49868	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.893013954 CET	19354	49867	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.904314041 CET	19354	49868	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:05.904419899 CET	49868	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:05.905389071 CET	49868	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.145457983 CET	19354	49868	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.145561934 CET	49868	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.145716906 CET	19354	49868	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.145734072 CET	19354	49868	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.148644924 CET	49869	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.385713100 CET	19354	49868	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.389420986 CET	19354	49869	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.389602900 CET	49869	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.391520023 CET	49869	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.630536079 CET	19354	49869	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.630567074 CET	19354	49869	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.630731106 CET	49869	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.630732059 CET	49869	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.632200956 CET	19354	49869	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.648089886 CET	49869	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.649007082 CET	49870	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.871577024 CET	19354	49869	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.871591091 CET	19354	49869	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.891726017 CET	19354	49870	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:06.891799927 CET	49870	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:06.892440081 CET	49870	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.134568930 CET	19354	49870	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.134596109 CET	19354	49870	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.134679079 CET	49870	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.135099888 CET	19354	49870	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.137835979 CET	49870	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.138833046 CET	49871	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.377357960 CET	19354	49870	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.380153894 CET	19354	49871	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.380342960 CET	49871	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.380826950 CET	49871	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.621918917 CET	19354	49871	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.622024059 CET	49871	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.622056961 CET	19354	49871	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.622133017 CET	19354	49871	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.622196913 CET	49871	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.622816086 CET	49871	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.623778105 CET	49872	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.863399982 CET	19354	49871	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.863668919 CET	19354	49871	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.865916014 CET	19354	49872	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:07.866038084 CET	49872	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:07.866667032 CET	49872	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.108186007 CET	19354	49872	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.108252048 CET	49872	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.108459949 CET	19354	49872	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.108499050 CET	49872	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.108675957 CET	19354	49872	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.111504078 CET	49872	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.112500906 CET	49873	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.350435019 CET	19354	49872	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.350565910 CET	19354	49872	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.353104115 CET	19354	49873	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.353205919 CET	49873	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.354126930 CET	49873	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.594233036 CET	19354	49873	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.594244957 CET	19354	49873	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.594470978 CET	49873	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.594830036 CET	49873	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.594887972 CET	19354	49873	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.596034050 CET	49874	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.835392952 CET	19354	49873	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.839776039 CET	19354	49874	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:08.839873075 CET	49874	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:08.860526085 CET	49874	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.083695889 CET	19354	49874	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.083914995 CET	49874	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.083945990 CET	19354	49874	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.084089994 CET	49874	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.084774017 CET	49874	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.085805893 CET	49875	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.104196072 CET	19354	49874	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.327788115 CET	19354	49874	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.327908039 CET	19354	49874	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.330935001 CET	19354	49875	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.331136942 CET	49875	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.335660934 CET	49875	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.576251030 CET	19354	49875	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.576394081 CET	19354	49875	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.576469898 CET	49875	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.579016924 CET	49875	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.580585003 CET	19354	49875	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.584830046 CET	49875	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.585922956 CET	49876	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:09.821598053 CET	19354	49875	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.823901892 CET	19354	49875	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.824861050 CET	19354	49876	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:09.824944973 CET	49876	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:10.064209938 CET	19354	49876	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:10.064229012 CET	19354	49876	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:10.064307928 CET	49876	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.164509058 CET	49876	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.173593998 CET	49876	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.174559116 CET	49877	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.403527021 CET	19354	49876	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:11.415786982 CET	19354	49877	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:11.415895939 CET	49877	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.416435003 CET	49877	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.657162905 CET	19354	49877	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:11.657182932 CET	19354	49877	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:11.657336950 CET	49877	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.657336950 CET	49877	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.657448053 CET	19354	49877	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:11.658480883 CET	49877	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.659667969 CET	49878	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.898489952 CET	19354	49877	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:11.898504019 CET	19354	49877	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:11.902357101 CET	19354	49878	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:11.902466059 CET	49878	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:11.903317928 CET	49878	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.145150900 CET	19354	49878	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.145204067 CET	49878	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.145302057 CET	19354	49878	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.145349979 CET	49878	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.145694017 CET	49878	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.145807981 CET	19354	49878	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.146806955 CET	49879	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.387794018 CET	19354	49878	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.387945890 CET	19354	49878	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.389004946 CET	19354	49879	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.389092922 CET	49879	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.389729977 CET	49879	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.631191015 CET	19354	49879	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.631221056 CET	19354	49879	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.631314039 CET	49879	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.631776094 CET	49879	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.631961107 CET	19354	49879	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.632822990 CET	49880	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.872021914 CET	19354	49880	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:12.872111082 CET	49880	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.872848034 CET	49880	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:12.873217106 CET	19354	49879	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.111409903 CET	19354	49880	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.111628056 CET	49880	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.111691952 CET	19354	49880	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.111701965 CET	19354	49880	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.111742973 CET	49880	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.112974882 CET	49880	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.114247084 CET	49881	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.350646973 CET	19354	49880	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.350661039 CET	19354	49880	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.354388952 CET	19354	49881	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.354485989 CET	49881	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.355381012 CET	49881	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.594638109 CET	19354	49881	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.594671965 CET	19354	49881	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.594722033 CET	49881	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.594882965 CET	49881	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.595361948 CET	19354	49881	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.595581055 CET	49881	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.596605062 CET	49882	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.834805965 CET	19354	49881	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.834973097 CET	19354	49881	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.839142084 CET	19354	49882	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:13.839348078 CET	49882	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:13.841892004 CET	49882	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.082170963 CET	19354	49882	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.082204103 CET	19354	49882	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.082438946 CET	49882	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.084367037 CET	19354	49882	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.091613054 CET	49882	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.092966080 CET	49883	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.324959993 CET	19354	49882	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.333758116 CET	19354	49883	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.333863974 CET	49883	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.334660053 CET	49883	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.574954033 CET	19354	49883	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.574984074 CET	19354	49883	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.575084925 CET	49883	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.575352907 CET	19354	49883	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.575464010 CET	49883	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.576396942 CET	49884	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.817833900 CET	19354	49883	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.817989111 CET	19354	49884	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:14.818084955 CET	49884	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:14.818820953 CET	49884	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.059156895 CET	19354	49884	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.059211969 CET	19354	49884	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.059221983 CET	19354	49884	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.059251070 CET	49884	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.059267998 CET	49884	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.059801102 CET	49884	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.060992956 CET	49885	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.299524069 CET	19354	49884	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.299540997 CET	19354	49884	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.299698114 CET	19354	49885	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.299806118 CET	49885	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.300658941 CET	49885	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.538606882 CET	19354	49885	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.538619995 CET	19354	49885	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.538707018 CET	49885	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.539098024 CET	49885	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.539329052 CET	19354	49885	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.540044069 CET	49886	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.777340889 CET	19354	49885	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.784933090 CET	19354	49886	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:15.785168886 CET	49886	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:15.787605047 CET	49886	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.032563925 CET	19354	49886	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.032779932 CET	49886	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.033802986 CET	19354	49886	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.033814907 CET	19354	49886	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.034917116 CET	49887	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.274789095 CET	19354	49887	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.274872065 CET	49887	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.275490999 CET	49887	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.277467012 CET	19354	49886	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.514812946 CET	19354	49887	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.514852047 CET	19354	49887	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.514863014 CET	49887	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.514889956 CET	49887	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.515400887 CET	19354	49887	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.516911983 CET	49887	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.518111944 CET	49888	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.754740953 CET	19354	49887	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.754765987 CET	19354	49887	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.760481119 CET	19354	49888	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:16.760653973 CET	49888	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:16.761193037 CET	49888	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.002888918 CET	19354	49888	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.002918959 CET	19354	49888	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.003077030 CET	49888	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.003077030 CET	49888	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.003202915 CET	19354	49888	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.003878117 CET	49888	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.004878044 CET	49889	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.245440006 CET	19354	49888	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.245455980 CET	19354	49888	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.247199059 CET	19354	49889	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.247283936 CET	49889	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.247936010 CET	49889	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.489506960 CET	19354	49889	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.489521027 CET	19354	49889	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.489613056 CET	49889	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.489862919 CET	19354	49889	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.489983082 CET	49889	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.490834951 CET	49890	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.729840040 CET	19354	49890	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.729908943 CET	49890	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.730881929 CET	49890	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.731641054 CET	19354	49889	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.968944073 CET	19354	49890	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.968974113 CET	19354	49890	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.969043970 CET	49890	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.969640970 CET	19354	49890	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:17.971303940 CET	49890	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:17.972367048 CET	49891	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.207885981 CET	19354	49890	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.217685938 CET	19354	49891	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.217812061 CET	49891	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.218918085 CET	49891	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.463402987 CET	19354	49891	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.463462114 CET	49891	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.463551998 CET	19354	49891	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.463599920 CET	49891	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.464215040 CET	19354	49891	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.467624903 CET	49891	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.468641996 CET	49892	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.708811998 CET	19354	49891	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.709148884 CET	19354	49891	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.709455013 CET	19354	49892	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.709625006 CET	49892	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.710202932 CET	49892	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.950949907 CET	19354	49892	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.950962067 CET	19354	49892	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.950975895 CET	19354	49892	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:18.951026917 CET	49892	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.951430082 CET	49892	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:18.952469110 CET	49893	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.191690922 CET	19354	49892	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.194046974 CET	19354	49893	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.194159031 CET	49893	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.207463026 CET	49893	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.436122894 CET	19354	49893	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.436140060 CET	19354	49893	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.436192989 CET	49893	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.436244965 CET	49893	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.437010050 CET	49893	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.438045979 CET	49894	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.448993921 CET	19354	49893	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.674865961 CET	19354	49894	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.674969912 CET	49894	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.676848888 CET	49894	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.677746058 CET	19354	49893	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.678020954 CET	19354	49893	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.911871910 CET	19354	49894	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.911904097 CET	19354	49894	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:19.912087917 CET	49894	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.912436962 CET	49894	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.913486004 CET	49895	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:19.913552046 CET	19354	49894	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.148991108 CET	19354	49894	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.152940035 CET	19354	49895	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.153018951 CET	49895	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.153537035 CET	49895	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.392653942 CET	19354	49895	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.392688990 CET	19354	49895	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.392745018 CET	49895	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.392770052 CET	49895	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.393430948 CET	19354	49895	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.397279978 CET	49895	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.398325920 CET	49896	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.632333040 CET	19354	49895	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.632590055 CET	19354	49895	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.640161037 CET	19354	49896	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.640253067 CET	49896	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.640928984 CET	49896	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.882162094 CET	19354	49896	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.882180929 CET	19354	49896	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.882239103 CET	49896	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.882272005 CET	49896	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.882572889 CET	19354	49896	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:20.886425972 CET	49896	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:20.887332916 CET	49897	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.124298096 CET	19354	49896	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.124310017 CET	19354	49896	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.129694939 CET	19354	49897	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.129759073 CET	49897	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.130354881 CET	49897	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.371808052 CET	19354	49897	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.371823072 CET	19354	49897	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.371866941 CET	49897	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.371896029 CET	49897	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.372186899 CET	19354	49897	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.372487068 CET	49897	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.374423027 CET	49898	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.611987114 CET	19354	49898	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.612104893 CET	49898	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.612585068 CET	49898	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.613822937 CET	19354	49897	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.613833904 CET	19354	49897	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.849919081 CET	19354	49898	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.849948883 CET	19354	49898	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.850034952 CET	49898	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.850207090 CET	19354	49898	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:21.850687027 CET	49898	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:21.851819992 CET	49899	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.087678909 CET	19354	49898	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.090774059 CET	19354	49899	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.090878010 CET	49899	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.091445923 CET	49899	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.329920053 CET	19354	49899	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.329935074 CET	19354	49899	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.330010891 CET	49899	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.330429077 CET	19354	49899	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.331496000 CET	49899	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.332475901 CET	49900	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.568813086 CET	19354	49899	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.574275017 CET	19354	49900	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.575066090 CET	49900	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.575675011 CET	49900	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.817137003 CET	19354	49900	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.817174911 CET	19354	49900	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.817240000 CET	49900	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.817260027 CET	49900	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.817267895 CET	19354	49900	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:22.818811893 CET	49900	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:22.825011015 CET	49901	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.058875084 CET	19354	49900	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.059142113 CET	19354	49900	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.068875074 CET	19354	49901	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.068970919 CET	49901	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.075689077 CET	49901	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.312835932 CET	19354	49901	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.312865973 CET	19354	49901	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.312951088 CET	49901	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.313941956 CET	49901	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.314944029 CET	49902	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.319322109 CET	19354	49901	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.554207087 CET	19354	49902	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.554328918 CET	49902	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.554899931 CET	49902	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.556590080 CET	19354	49901	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.793339014 CET	19354	49902	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.793354034 CET	19354	49902	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.793401957 CET	49902	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.793433905 CET	49902	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.793884039 CET	19354	49902	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:23.818056107 CET	49902	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:23.824942112 CET	49903	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.032529116 CET	19354	49902	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.032546043 CET	19354	49902	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.069889069 CET	19354	49903	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.069998026 CET	49903	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.070626974 CET	49903	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.315324068 CET	19354	49903	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.315354109 CET	19354	49903	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.315363884 CET	19354	49903	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.315419912 CET	49903	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.317318916 CET	49903	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.318305016 CET	49904	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.560240984 CET	19354	49903	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.562252998 CET	19354	49904	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.562325954 CET	49904	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.562802076 CET	49904	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.806526899 CET	19354	49904	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.806588888 CET	49904	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.806672096 CET	19354	49904	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.806715012 CET	49904	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.806834936 CET	19354	49904	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:24.808693886 CET	49904	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:24.809742928 CET	49905	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.048332930 CET	19354	49905	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.048403978 CET	49905	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.049007893 CET	49905	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.050616026 CET	19354	49904	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.050751925 CET	19354	49904	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.286761045 CET	19354	49905	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.286789894 CET	19354	49905	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.286864042 CET	49905	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.287281990 CET	19354	49905	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.287719011 CET	49905	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.288741112 CET	49906	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.525140047 CET	19354	49905	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.529603958 CET	19354	49906	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.529670000 CET	49906	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.530241966 CET	49906	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.770668030 CET	19354	49906	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.770785093 CET	49906	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.770792961 CET	19354	49906	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.770860910 CET	49906	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.771182060 CET	19354	49906	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:25.789885044 CET	49906	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:25.791054964 CET	49907	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.011781931 CET	19354	49906	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.011810064 CET	19354	49906	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.033204079 CET	19354	49907	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.033304930 CET	49907	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.034167051 CET	49907	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.275854111 CET	19354	49907	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.275866985 CET	19354	49907	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.275929928 CET	49907	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.276933908 CET	19354	49907	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.280822992 CET	49907	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.281846046 CET	49908	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.518055916 CET	19354	49907	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.520040989 CET	19354	49908	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.520126104 CET	49908	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.520668030 CET	49908	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.758749008 CET	19354	49908	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.758764029 CET	19354	49908	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.758826017 CET	49908	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.758872032 CET	19354	49908	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:26.881875038 CET	49908	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.882935047 CET	49909	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:26.997090101 CET	19354	49908	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:27.120764971 CET	19354	49909	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:27.120856047 CET	49909	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:27.121366978 CET	49909	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:27.358840942 CET	19354	49909	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:27.358859062 CET	19354	49909	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:27.358944893 CET	49909	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:27.359477043 CET	19354	49909	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:27.596744061 CET	19354	49909	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:28.149235010 CET	49910	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:28.394499063 CET	19354	49910	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:28.394592047 CET	49910	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:28.395112991 CET	49910	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:28.641465902 CET	19354	49910	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:28.641541004 CET	49910	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:28.641642094 CET	19354	49910	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:28.641654968 CET	19354	49910	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:28.642977953 CET	49911	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:28.884763956 CET	19354	49911	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:28.884860992 CET	49911	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:28.886652946 CET	19354	49910	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:28.906033993 CET	49911	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.126679897 CET	19354	49911	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.126693964 CET	19354	49911	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.126763105 CET	49911	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.126796007 CET	49911	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.127468109 CET	49911	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.128417969 CET	49912	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.147785902 CET	19354	49911	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.367847919 CET	19354	49912	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.367940903 CET	49912	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.368484020 CET	49912	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.368525028 CET	19354	49911	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.368558884 CET	19354	49911	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.607717037 CET	19354	49912	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.607731104 CET	19354	49912	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.607772112 CET	49912	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.607783079 CET	49912	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.607906103 CET	19354	49912	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.609123945 CET	49912	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.610162020 CET	49913	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.846942902 CET	19354	49913	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.847039938 CET	49913	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:29.847089052 CET	19354	49912	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.847115993 CET	19354	49912	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:29.847667933 CET	49913	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.084136963 CET	19354	49913	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.084167957 CET	19354	49913	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.084233999 CET	49913	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.084369898 CET	19354	49913	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.084937096 CET	49913	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.085985899 CET	49914	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.321260929 CET	19354	49913	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.329240084 CET	19354	49914	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.329405069 CET	49914	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.329854965 CET	49914	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.573014975 CET	19354	49914	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.573045969 CET	19354	49914	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.573056936 CET	19354	49914	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.573263884 CET	49914	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.575620890 CET	49914	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.578362942 CET	49915	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.816834927 CET	19354	49914	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.823929071 CET	19354	49915	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:30.824013948 CET	49915	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:30.824594021 CET	49915	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.069957972 CET	19354	49915	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.069988966 CET	19354	49915	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.070003986 CET	19354	49915	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.070055008 CET	49915	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.070086002 CET	49915	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.074744940 CET	49915	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.075733900 CET	49916	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.315239906 CET	19354	49916	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.315320015 CET	49916	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.315709114 CET	19354	49915	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.315721035 CET	19354	49915	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.315994978 CET	49916	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.555347919 CET	19354	49916	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.555387020 CET	19354	49916	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.555531025 CET	19354	49916	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.555556059 CET	49916	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.558490992 CET	49916	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.564891100 CET	49917	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.795111895 CET	19354	49916	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.804136992 CET	19354	49917	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:31.804239035 CET	49917	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:31.804979086 CET	49917	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.043890953 CET	19354	49917	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.043910980 CET	19354	49917	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.043951988 CET	49917	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.043978930 CET	49917	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.044162035 CET	19354	49917	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.044279099 CET	49917	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.045341969 CET	49918	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.283272982 CET	19354	49917	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.283307076 CET	19354	49917	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.287147045 CET	19354	49918	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.287466049 CET	49918	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.288100004 CET	49918	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.529608011 CET	19354	49918	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.529638052 CET	19354	49918	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.529783964 CET	19354	49918	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.529834986 CET	49918	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.532557011 CET	49918	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.533617973 CET	49919	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.771634102 CET	19354	49918	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.775784969 CET	19354	49919	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:32.775870085 CET	49919	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:32.776504993 CET	49919	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.018125057 CET	19354	49919	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:33.018232107 CET	19354	49919	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:33.018377066 CET	49919	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.018696070 CET	19354	49919	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:33.022859097 CET	49919	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.023933887 CET	49920	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.260523081 CET	19354	49919	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:33.269330025 CET	19354	49920	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:33.269412994 CET	49920	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.270015001 CET	49920	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.515130043 CET	19354	49920	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:33.515158892 CET	19354	49920	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:33.515223980 CET	49920	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.515513897 CET	19354	49920	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:33.515614986 CET	49920	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.516644955 CET	49921	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.759016037 CET	19354	49921	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:33.759085894 CET	49921	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.759907961 CET	49921	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:33.760592937 CET	19354	49920	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.001640081 CET	19354	49921	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.001657009 CET	19354	49921	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.001694918 CET	49921	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.001713991 CET	49921	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.002130032 CET	19354	49921	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.002414942 CET	49921	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.003412962 CET	49922	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.243258953 CET	19354	49922	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.243379116 CET	49922	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.244031906 CET	19354	49921	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.244044065 CET	19354	49921	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.244220018 CET	49922	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.483573914 CET	19354	49922	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.483586073 CET	19354	49922	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.483644962 CET	49922	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.484023094 CET	19354	49922	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.485739946 CET	49922	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.486963987 CET	49923	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.723577976 CET	19354	49922	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.725251913 CET	19354	49923	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.725446939 CET	49923	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.726285934 CET	49923	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.963923931 CET	19354	49923	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.963938951 CET	19354	49923	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.964003086 CET	49923	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.964481115 CET	19354	49923	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:34.965643883 CET	49923	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:34.966983080 CET	49924	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.202204943 CET	19354	49923	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.206636906 CET	19354	49924	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.206840038 CET	49924	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.208692074 CET	49924	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.446645021 CET	19354	49924	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.446660995 CET	19354	49924	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.446749926 CET	49924	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.446763992 CET	49924	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.448369026 CET	19354	49924	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.450777054 CET	49924	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.451937914 CET	49925	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.686428070 CET	19354	49924	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.686444044 CET	19354	49924	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.694356918 CET	19354	49925	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.694566965 CET	49925	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.700119972 CET	49925	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.937163115 CET	19354	49925	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.937176943 CET	19354	49925	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:35.937314034 CET	49925	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.940340996 CET	49925	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.941327095 CET	49926	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:35.942847013 CET	19354	49925	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.180068016 CET	19354	49925	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.181183100 CET	19354	49926	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.181257010 CET	49926	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:36.181869030 CET	49926	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:36.421319962 CET	19354	49926	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.421334028 CET	19354	49926	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.421422958 CET	49926	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:36.421602964 CET	19354	49926	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.423497915 CET	49926	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:36.424434900 CET	49927	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:36.661418915 CET	19354	49926	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.665074110 CET	19354	49927	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.665158987 CET	49927	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:36.665802002 CET	49927	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:36.906011105 CET	19354	49927	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.906040907 CET	19354	49927	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.906208992 CET	49927	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:36.906511068 CET	19354	49927	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:36.913603067 CET	49927	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:36.914617062 CET	49928	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.147092104 CET	19354	49927	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.156224966 CET	19354	49928	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.156461000 CET	49928	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.157074928 CET	49928	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.398397923 CET	19354	49928	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.398427010 CET	19354	49928	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.398459911 CET	49928	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.398478985 CET	49928	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.398658037 CET	19354	49928	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.402699947 CET	49928	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.408833027 CET	49929	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.640117884 CET	19354	49928	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.640151024 CET	19354	49928	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.652648926 CET	19354	49929	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.652751923 CET	49929	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.653403044 CET	49929	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.896857023 CET	19354	49929	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.896872044 CET	19354	49929	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.897118092 CET	19354	49929	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:37.897151947 CET	49929	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.904026985 CET	49929	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:37.904911995 CET	49930	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.140923977 CET	19354	49929	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.144252062 CET	19354	49930	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.144328117 CET	49930	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.144939899 CET	49930	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.383876085 CET	19354	49930	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.383888006 CET	19354	49930	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.383929968 CET	49930	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.383949995 CET	49930	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.384054899 CET	19354	49930	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.384315968 CET	49930	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.385919094 CET	49931	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.623281002 CET	19354	49930	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.623294115 CET	19354	49930	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.627387047 CET	19354	49931	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.627459049 CET	49931	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.628083944 CET	49931	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.868874073 CET	19354	49931	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.868887901 CET	19354	49931	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.869093895 CET	49931	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.869370937 CET	19354	49931	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:38.874104977 CET	49931	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:38.875235081 CET	49932	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.110445023 CET	19354	49931	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.116451025 CET	19354	49932	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.116652012 CET	49932	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.117146969 CET	49932	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.357981920 CET	19354	49932	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.357995987 CET	19354	49932	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.358194113 CET	19354	49932	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.358212948 CET	49932	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.358894110 CET	49932	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.359874010 CET	49933	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.599930048 CET	19354	49932	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.600874901 CET	19354	49933	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.600970984 CET	49933	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.601759911 CET	49933	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.842132092 CET	19354	49933	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.842148066 CET	19354	49933	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.842195988 CET	49933	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.842211962 CET	49933	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.842735052 CET	19354	49933	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:39.844507933 CET	49933	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:39.845573902 CET	49934	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.083193064 CET	19354	49933	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.083204985 CET	19354	49933	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.084427118 CET	19354	49934	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.084595919 CET	49934	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.085125923 CET	49934	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.323785067 CET	19354	49934	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.323813915 CET	19354	49934	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.323913097 CET	19354	49934	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.323985100 CET	49934	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.324261904 CET	49934	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.325246096 CET	49935	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.563108921 CET	19354	49934	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.563627005 CET	19354	49935	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.563690901 CET	49935	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.565443993 CET	49935	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.802253962 CET	19354	49935	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.802287102 CET	19354	49935	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:40.802366972 CET	49935	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.802519083 CET	49935	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.802669048 CET	49935	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.803649902 CET	49936	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:40.803776026 CET	19354	49935	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.040888071 CET	19354	49935	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.040901899 CET	19354	49935	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.042419910 CET	19354	49936	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.042488098 CET	49936	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.043152094 CET	49936	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.281435013 CET	19354	49936	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.281447887 CET	19354	49936	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.281512022 CET	49936	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.281527042 CET	49936	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.281981945 CET	19354	49936	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.286573887 CET	49936	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.287642002 CET	49937	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.520378113 CET	19354	49936	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.520394087 CET	19354	49936	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.527050018 CET	19354	49937	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.527242899 CET	49937	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.527797937 CET	49937	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.768418074 CET	19354	49937	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.768435001 CET	19354	49937	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.768490076 CET	49937	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.768507004 CET	49937	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.768765926 CET	19354	49937	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:41.786653996 CET	49937	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:41.787883997 CET	49938	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.007947922 CET	19354	49937	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.008009911 CET	19354	49937	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.029975891 CET	19354	49938	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.030061007 CET	49938	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.031161070 CET	49938	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.272367001 CET	19354	49938	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.272397995 CET	19354	49938	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.272685051 CET	49938	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.273191929 CET	19354	49938	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.274019003 CET	49938	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.275996923 CET	49939	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.514861107 CET	19354	49938	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.517302036 CET	19354	49939	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.517493963 CET	49939	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.518312931 CET	49939	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.759373903 CET	19354	49939	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.759387970 CET	19354	49939	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.759460926 CET	19354	49939	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:42.759588957 CET	49939	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.762291908 CET	49939	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:42.763425112 CET	49940	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.000885010 CET	19354	49939	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.008304119 CET	19354	49940	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.008485079 CET	49940	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.008933067 CET	49940	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.253573895 CET	19354	49940	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.253602982 CET	19354	49940	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.253618956 CET	19354	49940	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.253907919 CET	49940	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.257479906 CET	49940	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.258495092 CET	49941	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.497854948 CET	19354	49941	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.498111963 CET	49941	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.498606920 CET	49941	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.498866081 CET	19354	49940	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.737835884 CET	19354	49941	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.737867117 CET	19354	49941	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.737895012 CET	19354	49941	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.737971067 CET	49941	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.749345064 CET	49941	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.750307083 CET	49942	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.977339029 CET	19354	49941	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.992221117 CET	19354	49942	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:43.992300034 CET	49942	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:43.992909908 CET	49942	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.234534979 CET	19354	49942	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.234586000 CET	19354	49942	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.234618902 CET	49942	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.234654903 CET	49942	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.234802008 CET	19354	49942	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.241051912 CET	49942	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.242070913 CET	49943	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.476713896 CET	19354	49942	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.476752043 CET	19354	49942	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.482570887 CET	19354	49943	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.482649088 CET	49943	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.719248056 CET	49943	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.723102093 CET	19354	49943	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.723117113 CET	19354	49943	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.723176003 CET	49943	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.725137949 CET	49943	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.726350069 CET	49944	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.959578991 CET	19354	49943	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.963910103 CET	19354	49943	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.971302986 CET	19354	49944	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:44.971385956 CET	49944	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:44.971901894 CET	49944	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:45.216753960 CET	19354	49944	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:45.216768980 CET	19354	49944	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:45.216850996 CET	49944	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:45.216932058 CET	19354	49944	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:45.461961985 CET	19354	49944	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:45.700562954 CET	49945	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:45.941350937 CET	19354	49945	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:45.941459894 CET	49945	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.067667961 CET	49945	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.180527925 CET	19354	49945	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.180541992 CET	19354	49945	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.180591106 CET	49945	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.241590023 CET	49945	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.242542028 CET	49946	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.306567907 CET	19354	49945	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.420665979 CET	19354	49945	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.487689018 CET	19354	49946	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.487783909 CET	49946	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.488337994 CET	49946	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.733109951 CET	19354	49946	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.733125925 CET	19354	49946	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.733186960 CET	49946	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.733326912 CET	19354	49946	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.741055012 CET	49946	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.742060900 CET	49947	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.979406118 CET	19354	49946	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.984344006 CET	19354	49947	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:46.984422922 CET	49947	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:46.987477064 CET	49947	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.226777077 CET	19354	49947	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.226790905 CET	19354	49947	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.226861000 CET	49947	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.229156971 CET	19354	49947	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.231462955 CET	49947	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.232496977 CET	49948	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.468615055 CET	19354	49947	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.471496105 CET	19354	49948	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.471555948 CET	49948	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.472153902 CET	49948	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.711620092 CET	19354	49948	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.711658001 CET	19354	49948	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.711739063 CET	49948	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.711997986 CET	19354	49948	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.714875937 CET	49948	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.716499090 CET	49949	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.950674057 CET	19354	49948	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.955391884 CET	19354	49949	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:47.955466032 CET	49949	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:47.956084013 CET	49949	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.194494009 CET	19354	49949	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.194545031 CET	19354	49949	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.194602013 CET	49949	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.194633961 CET	49949	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.194894075 CET	49949	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.195159912 CET	19354	49949	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.195883036 CET	49950	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.433723927 CET	19354	49949	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.433736086 CET	19354	49949	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.436058998 CET	19354	49950	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.436136961 CET	49950	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.439896107 CET	49950	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.676570892 CET	19354	49950	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.676584959 CET	19354	49950	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.676662922 CET	49950	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.678436041 CET	49950	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.679470062 CET	49951	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.680088997 CET	19354	49950	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.917038918 CET	19354	49950	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.921293974 CET	19354	49951	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:48.921498060 CET	49951	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:48.922025919 CET	49951	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.163520098 CET	19354	49951	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.163535118 CET	19354	49951	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.163583994 CET	19354	49951	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.163585901 CET	49951	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.163606882 CET	49951	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.168627977 CET	49951	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.169575930 CET	49952	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.405949116 CET	19354	49951	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.405983925 CET	19354	49951	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.411510944 CET	19354	49952	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.411617041 CET	49952	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.412198067 CET	49952	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.653701067 CET	19354	49952	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.653738976 CET	19354	49952	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.653811932 CET	49952	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.653832912 CET	49952	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.654095888 CET	19354	49952	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.654230118 CET	49952	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.655230999 CET	49953	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.895884991 CET	19354	49952	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.895921946 CET	19354	49952	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.898601055 CET	19354	49953	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:49.898705006 CET	49953	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:49.899296045 CET	49953	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.142419100 CET	19354	49953	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.142447948 CET	19354	49953	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.142455101 CET	19354	49953	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.142652988 CET	49953	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.142919064 CET	49953	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.143873930 CET	49954	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.385216951 CET	19354	49954	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.385283947 CET	49954	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.385871887 CET	19354	49953	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.385890961 CET	49954	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.627233982 CET	19354	49954	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.627266884 CET	19354	49954	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.627273083 CET	19354	49954	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.627454042 CET	49954	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.627799034 CET	49954	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.628846884 CET	49955	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.868824959 CET	19354	49954	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.874373913 CET	19354	49955	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:50.874497890 CET	49955	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:50.878259897 CET	49955	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.120467901 CET	19354	49955	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.120487928 CET	19354	49955	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.120532990 CET	49955	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.120556116 CET	49955	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.121081114 CET	49955	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.122394085 CET	49956	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.123806953 CET	19354	49955	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.363816023 CET	19354	49956	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.363938093 CET	49956	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.364435911 CET	49956	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.366056919 CET	19354	49955	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.366067886 CET	19354	49955	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.605427980 CET	19354	49956	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.605442047 CET	19354	49956	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.605514050 CET	49956	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.605724096 CET	19354	49956	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.611260891 CET	49956	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.615154982 CET	49957	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.846858978 CET	19354	49956	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.857522011 CET	19354	49957	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:51.857601881 CET	49957	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:51.858230114 CET	49957	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.099788904 CET	19354	49957	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.099807024 CET	19354	49957	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.099961996 CET	49957	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.100105047 CET	19354	49957	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.100433111 CET	49957	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.101391077 CET	49958	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.341461897 CET	19354	49958	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.341581106 CET	49958	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.341912985 CET	19354	49957	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.342235088 CET	49958	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.581765890 CET	19354	49958	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.581784010 CET	19354	49958	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.581860065 CET	49958	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.582112074 CET	19354	49958	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.582168102 CET	49958	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.583132029 CET	49959	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.821738958 CET	19354	49958	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.825690031 CET	19354	49959	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:52.825754881 CET	49959	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:52.826361895 CET	49959	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.069658995 CET	19354	49959	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.069677114 CET	19354	49959	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.069746971 CET	19354	49959	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.069860935 CET	49959	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.074568987 CET	49959	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.076632023 CET	49960	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.312629938 CET	19354	49959	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.320553064 CET	19354	49960	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.320628881 CET	49960	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.321127892 CET	49960	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.564986944 CET	19354	49960	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.565004110 CET	19354	49960	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.565099001 CET	49960	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.565120935 CET	19354	49960	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.566457033 CET	49960	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.567334890 CET	49961	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.809132099 CET	19354	49960	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.810590029 CET	19354	49961	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:53.810693979 CET	49961	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:53.811310053 CET	49961	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.054114103 CET	19354	49961	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.054127932 CET	19354	49961	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.054177046 CET	49961	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.054207087 CET	49961	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.054480076 CET	19354	49961	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.059052944 CET	49961	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.060163975 CET	49962	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.298388004 CET	19354	49961	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.298408031 CET	19354	49961	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.300668955 CET	19354	49962	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.300786972 CET	49962	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.301440001 CET	49962	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.541383982 CET	19354	49962	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.541400909 CET	19354	49962	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.541480064 CET	49962	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.541743994 CET	19354	49962	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.543427944 CET	49962	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.544425964 CET	49963	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.781980038 CET	19354	49962	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.785084009 CET	19354	49963	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:54.785188913 CET	49963	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:54.785799980 CET	49963	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.027542114 CET	19354	49963	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.027559042 CET	19354	49963	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.027569056 CET	19354	49963	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.027646065 CET	49963	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.027671099 CET	49963	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.028031111 CET	49963	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.029056072 CET	49964	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.268513918 CET	19354	49963	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.268548012 CET	19354	49963	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.271220922 CET	19354	49964	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.271317959 CET	49964	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.271905899 CET	49964	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.513848066 CET	19354	49964	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.513864040 CET	19354	49964	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.513902903 CET	49964	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.513917923 CET	19354	49964	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.513926029 CET	49964	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.515176058 CET	49964	19354	192.168.2.4	3.127.138.57
Dec 30, 2023 06:59:55.639142036 CET	49965	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:55.756006956 CET	19354	49964	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.756020069 CET	19354	49964	3.127.138.57	192.168.2.4
Dec 30, 2023 06:59:55.877717018 CET	19354	49965	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:55.877825022 CET	49965	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:55.878340960 CET	49965	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.116473913 CET	19354	49965	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.116496086 CET	19354	49965	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.116605043 CET	49965	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.116811037 CET	19354	49965	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.121431112 CET	49965	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.123465061 CET	49966	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.355154037 CET	19354	49965	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.364146948 CET	19354	49966	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.364238977 CET	49966	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.364851952 CET	49966	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.605109930 CET	19354	49966	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.605127096 CET	19354	49966	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.605197906 CET	49966	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.605509043 CET	19354	49966	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.606209040 CET	49966	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.607172966 CET	49967	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.845921040 CET	19354	49966	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.849745989 CET	19354	49967	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:56.849853992 CET	49967	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:56.850603104 CET	49967	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.092624903 CET	19354	49967	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.092641115 CET	19354	49967	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.092698097 CET	49967	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.092715025 CET	49967	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.093153954 CET	19354	49967	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.127203941 CET	49967	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.128597021 CET	49968	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.335257053 CET	19354	49967	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.335273027 CET	19354	49967	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.368777037 CET	19354	49968	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.368850946 CET	49968	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.372313023 CET	49968	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.609276056 CET	19354	49968	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.609303951 CET	19354	49968	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.609467030 CET	49968	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.609925032 CET	49968	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.611018896 CET	49969	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.612298965 CET	19354	49968	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.849560976 CET	19354	49968	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.852940083 CET	19354	49969	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:57.853041887 CET	49969	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:57.853565931 CET	49969	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.095192909 CET	19354	49969	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.095211029 CET	19354	49969	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.095277071 CET	49969	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.095313072 CET	49969	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.095386028 CET	19354	49969	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.096364021 CET	49969	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.097332954 CET	49970	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.336929083 CET	19354	49970	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.337054968 CET	49970	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.337253094 CET	19354	49969	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.337264061 CET	19354	49969	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.337721109 CET	49970	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.576673985 CET	19354	49970	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.576687098 CET	19354	49970	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.576786995 CET	49970	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.577111959 CET	49970	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.577164888 CET	19354	49970	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.578186035 CET	49971	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.817092896 CET	19354	49970	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.823817968 CET	19354	49971	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:58.823887110 CET	49971	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:58.824501038 CET	49971	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:59.069135904 CET	19354	49971	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.069165945 CET	19354	49971	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.069361925 CET	49971	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:59.069392920 CET	19354	49971	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.069981098 CET	49971	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:59.071018934 CET	49972	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:59.313558102 CET	19354	49972	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.313667059 CET	49972	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:59.314289093 CET	49972	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:59.314460039 CET	19354	49971	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.556859970 CET	19354	49972	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.556917906 CET	49972	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:59.562789917 CET	19354	49972	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.562829018 CET	19354	49972	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.576169014 CET	49973	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:59.799607992 CET	19354	49972	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.822484970 CET	19354	49973	3.126.37.18	192.168.2.4
Dec 30, 2023 06:59:59.822788954 CET	49973	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 06:59:59.823164940 CET	49973	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.069133997 CET	19354	49973	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.069145918 CET	19354	49973	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.069156885 CET	19354	49973	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.069190025 CET	49973	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.069220066 CET	49973	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.069484949 CET	49973	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.070622921 CET	49974	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.315565109 CET	19354	49973	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.315594912 CET	19354	49973	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.316356897 CET	19354	49974	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.316452980 CET	49974	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.317197084 CET	49974	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.562249899 CET	19354	49974	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.562263966 CET	19354	49974	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.562308073 CET	49974	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.562323093 CET	49974	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.562774897 CET	19354	49974	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.605292082 CET	49974	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.606206894 CET	49975	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.808042049 CET	19354	49974	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.808073044 CET	19354	49974	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.846061945 CET	19354	49975	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:00.846421003 CET	49975	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:00.846777916 CET	49975	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.086410999 CET	19354	49975	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.086426020 CET	19354	49975	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.086539984 CET	49975	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.086600065 CET	19354	49975	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.089334011 CET	49975	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.091253042 CET	49976	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.326582909 CET	19354	49975	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.332062006 CET	19354	49976	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.332159042 CET	49976	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.334423065 CET	49976	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.572926044 CET	19354	49976	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.572943926 CET	19354	49976	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.573004007 CET	49976	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.573029041 CET	49976	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.574796915 CET	19354	49976	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.580219984 CET	49976	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.584264040 CET	49977	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.814105988 CET	19354	49976	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.814117908 CET	19354	49976	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.826865911 CET	19354	49977	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:01.826992035 CET	49977	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:01.827517986 CET	49977	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.069555998 CET	19354	49977	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.069592953 CET	19354	49977	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.069880009 CET	49977	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.070014000 CET	19354	49977	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.085035086 CET	49977	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.085974932 CET	49978	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.312299967 CET	19354	49977	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.330743074 CET	19354	49978	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.330872059 CET	49978	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.331532001 CET	49978	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.575797081 CET	19354	49978	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.575834990 CET	19354	49978	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.576014042 CET	49978	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.576014042 CET	49978	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.576148987 CET	19354	49978	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.593498945 CET	49978	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.595742941 CET	49979	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.820727110 CET	19354	49978	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.820741892 CET	19354	49978	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.832957983 CET	19354	49979	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:02.833129883 CET	49979	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:02.833960056 CET	49979	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:03.071136951 CET	19354	49979	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:03.071151018 CET	19354	49979	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:03.071228027 CET	49979	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:03.071295977 CET	19354	49979	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:03.308660984 CET	19354	49979	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:03.524169922 CET	49980	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:03.767959118 CET	19354	49980	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:03.768275023 CET	49980	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:03.827429056 CET	49980	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.012288094 CET	19354	49980	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.012469053 CET	19354	49980	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.012515068 CET	49980	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.012547016 CET	49980	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.013031006 CET	49980	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.014092922 CET	49981	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.071188927 CET	19354	49980	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.256350994 CET	19354	49980	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.256362915 CET	19354	49980	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.257035017 CET	19354	49981	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.257217884 CET	49981	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.257675886 CET	49981	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.500144958 CET	19354	49981	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.500164032 CET	19354	49981	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.500207901 CET	49981	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.500247002 CET	49981	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.500370026 CET	19354	49981	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.506705046 CET	49981	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.507747889 CET	49982	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.742994070 CET	19354	49981	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.743026972 CET	19354	49981	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.747471094 CET	19354	49982	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.747674942 CET	49982	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.772515059 CET	49982	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.987541914 CET	19354	49982	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.987659931 CET	49982	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.987714052 CET	19354	49982	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:04.987762928 CET	49982	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.988151073 CET	49982	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:04.989115000 CET	49983	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.012424946 CET	19354	49982	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.227397919 CET	19354	49982	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.227432013 CET	19354	49982	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.233597040 CET	19354	49983	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.233694077 CET	49983	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.234339952 CET	49983	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.478694916 CET	19354	49983	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.478709936 CET	19354	49983	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.478720903 CET	19354	49983	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.478751898 CET	49983	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.478780985 CET	49983	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.491362095 CET	49983	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.492810965 CET	49984	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.723115921 CET	19354	49983	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.723157883 CET	19354	49983	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.731527090 CET	19354	49984	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.731734991 CET	49984	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.732244968 CET	49984	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.970717907 CET	19354	49984	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.970737934 CET	19354	49984	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.970953941 CET	49984	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.970982075 CET	19354	49984	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:05.973701954 CET	49984	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:05.974698067 CET	49985	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.209909916 CET	19354	49984	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.216156006 CET	19354	49985	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.216269970 CET	49985	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.216831923 CET	49985	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.457849979 CET	19354	49985	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.457863092 CET	19354	49985	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.458086014 CET	49985	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.458215952 CET	19354	49985	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.473659992 CET	49985	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.474736929 CET	49986	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.699574947 CET	19354	49985	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.716228962 CET	19354	49986	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.716415882 CET	49986	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.716981888 CET	49986	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.958065987 CET	19354	49986	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.958080053 CET	19354	49986	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.958268881 CET	49986	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.958415031 CET	19354	49986	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:06.959407091 CET	49986	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:06.960490942 CET	49987	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.200124025 CET	19354	49986	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.205202103 CET	19354	49987	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.205410957 CET	49987	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.206315041 CET	49987	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.450501919 CET	19354	49987	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.450521946 CET	19354	49987	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.450556040 CET	49987	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.450587034 CET	49987	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.450937033 CET	19354	49987	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.452820063 CET	49987	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.453963995 CET	49988	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.695204020 CET	19354	49987	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.695236921 CET	19354	49987	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.700108051 CET	19354	49988	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.700311899 CET	49988	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.700870037 CET	49988	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.946589947 CET	19354	49988	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.946603060 CET	19354	49988	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.946788073 CET	49988	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.947009087 CET	19354	49988	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:07.949224949 CET	49988	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:07.953690052 CET	49989	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.193142891 CET	19354	49988	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.194924116 CET	19354	49989	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.195044041 CET	49989	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.205585003 CET	49989	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.436180115 CET	19354	49989	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.436203003 CET	19354	49989	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.436279058 CET	49989	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.436655045 CET	49989	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.437726974 CET	49990	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.446456909 CET	19354	49989	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.677653074 CET	19354	49989	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.678944111 CET	19354	49990	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.679038048 CET	49990	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.679646015 CET	49990	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.920506001 CET	19354	49990	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.920538902 CET	19354	49990	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.920614004 CET	49990	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.920744896 CET	19354	49990	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:08.920778036 CET	49990	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.920909882 CET	49990	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:08.921916962 CET	49991	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.161843061 CET	19354	49990	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.161855936 CET	19354	49990	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.163105965 CET	19354	49991	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.163177967 CET	49991	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.163786888 CET	49991	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.404839993 CET	19354	49991	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.404872894 CET	19354	49991	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.404968977 CET	49991	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.405119896 CET	19354	49991	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.405461073 CET	49991	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.406491995 CET	49992	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.646545887 CET	19354	49991	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.651642084 CET	19354	49992	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.651751041 CET	49992	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.652740002 CET	49992	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.897053957 CET	19354	49992	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.897068977 CET	19354	49992	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.897175074 CET	49992	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.897175074 CET	49992	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.897819996 CET	19354	49992	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:09.898154974 CET	49992	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:09.899187088 CET	49993	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.138988018 CET	19354	49993	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.139101982 CET	49993	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.142623901 CET	19354	49992	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.142636061 CET	19354	49992	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.142760038 CET	49993	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.379029989 CET	19354	49993	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.379045963 CET	19354	49993	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.379084110 CET	49993	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.379103899 CET	49993	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.379956007 CET	49993	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.382167101 CET	19354	49993	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.382787943 CET	49994	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.618670940 CET	19354	49993	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.618685961 CET	19354	49993	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.624070883 CET	19354	49994	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.624170065 CET	49994	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.626827002 CET	49994	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.865657091 CET	19354	49994	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.865675926 CET	19354	49994	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:10.865712881 CET	49994	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.865735054 CET	49994	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.865999937 CET	49994	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.867156982 CET	49995	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:10.868136883 CET	19354	49994	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.106925011 CET	19354	49994	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.106939077 CET	19354	49994	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.109677076 CET	19354	49995	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.109781981 CET	49995	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.110411882 CET	49995	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.352372885 CET	19354	49995	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.352386951 CET	19354	49995	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.352582932 CET	49995	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.352670908 CET	19354	49995	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.357331038 CET	49995	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.358376026 CET	49996	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.595017910 CET	19354	49995	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.604732990 CET	19354	49996	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.604840994 CET	49996	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.636030912 CET	49996	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.851363897 CET	19354	49996	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.851411104 CET	19354	49996	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:11.851716042 CET	49996	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.856678009 CET	49996	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.857736111 CET	49997	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:11.882119894 CET	19354	49996	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.098004103 CET	19354	49996	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.103668928 CET	19354	49997	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.103887081 CET	49997	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.105094910 CET	49997	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.349893093 CET	19354	49997	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.349930048 CET	19354	49997	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.349997997 CET	49997	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.350039959 CET	49997	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.350430965 CET	49997	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.350704908 CET	19354	49997	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.351500034 CET	49998	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.594223976 CET	19354	49998	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.594305992 CET	49998	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.595313072 CET	49998	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.595896006 CET	19354	49997	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.595906019 CET	19354	49997	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.837162971 CET	19354	49998	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.837177038 CET	19354	49998	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.837253094 CET	49998	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.837873936 CET	19354	49998	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:12.840643883 CET	49998	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:12.844151020 CET	49999	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.080099106 CET	19354	49998	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.087552071 CET	19354	49999	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.087748051 CET	49999	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.088344097 CET	49999	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.331613064 CET	19354	49999	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.331657887 CET	19354	49999	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.331949949 CET	49999	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.332026005 CET	19354	49999	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.347501993 CET	49999	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.348644972 CET	50000	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.575334072 CET	19354	49999	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.594520092 CET	19354	50000	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.594809055 CET	50000	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.595230103 CET	50000	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.840796947 CET	19354	50000	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.840837955 CET	19354	50000	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.840979099 CET	19354	50000	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:13.841135025 CET	50000	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.841358900 CET	50000	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:13.842478037 CET	50001	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.085036993 CET	19354	50001	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.085119963 CET	50001	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.087037086 CET	19354	50000	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.107817888 CET	50001	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.327997923 CET	19354	50001	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.328010082 CET	19354	50001	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.328186989 CET	50001	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.329201937 CET	50001	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.330384970 CET	50002	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.350302935 CET	19354	50001	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.571037054 CET	19354	50001	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.573976040 CET	19354	50002	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.574141026 CET	50002	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.574938059 CET	50002	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.817866087 CET	19354	50002	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.817889929 CET	19354	50002	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.817994118 CET	50002	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.818501949 CET	50002	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:14.818566084 CET	19354	50002	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:14.820354939 CET	50003	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:15.062161922 CET	19354	50002	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.062176943 CET	19354	50003	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.062251091 CET	50003	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:15.062947989 CET	50003	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:15.304387093 CET	19354	50003	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.304449081 CET	50003	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:15.304694891 CET	19354	50003	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.304804087 CET	19354	50003	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.306823015 CET	50004	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:15.546217918 CET	19354	50003	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.546643972 CET	19354	50004	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.546807051 CET	50004	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:15.549434900 CET	50004	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:15.786933899 CET	19354	50004	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.786967993 CET	19354	50004	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.787254095 CET	50004	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:15.788094044 CET	50004	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:15.789165974 CET	19354	50004	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:15.789288998 CET	50005	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.027282000 CET	19354	50004	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.031347990 CET	19354	50005	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.031434059 CET	50005	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.032843113 CET	50005	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.273658037 CET	19354	50005	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.273674965 CET	19354	50005	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.273722887 CET	50005	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.273765087 CET	50005	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.274876118 CET	19354	50005	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.275381088 CET	50005	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.279021025 CET	50006	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.515851021 CET	19354	50005	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.515875101 CET	19354	50005	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.519469023 CET	19354	50006	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.519551992 CET	50006	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.520243883 CET	50006	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.760303974 CET	19354	50006	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.760596037 CET	19354	50006	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.760606050 CET	19354	50006	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:16.760623932 CET	50006	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.760798931 CET	50006	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.761670113 CET	50006	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:16.763000011 CET	50007	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.001051903 CET	19354	50006	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.001132011 CET	19354	50006	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.002371073 CET	19354	50007	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.002559900 CET	50007	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.003331900 CET	50007	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.241960049 CET	19354	50007	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.241980076 CET	19354	50007	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.242017984 CET	50007	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.242049932 CET	50007	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.242964983 CET	19354	50007	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.252898932 CET	50007	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.253923893 CET	50008	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.481240988 CET	19354	50007	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.481280088 CET	19354	50007	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.496656895 CET	19354	50008	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.496790886 CET	50008	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.503664970 CET	50008	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.739880085 CET	19354	50008	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.739903927 CET	19354	50008	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.739937067 CET	50008	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.739965916 CET	50008	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.746391058 CET	19354	50008	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.750790119 CET	50008	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.751976013 CET	50009	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.982930899 CET	19354	50008	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.982968092 CET	19354	50008	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.991729021 CET	19354	50009	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:17.991921902 CET	50009	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:17.992635012 CET	50009	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.231786966 CET	19354	50009	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.231806993 CET	19354	50009	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.231992960 CET	50009	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.232268095 CET	19354	50009	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.233133078 CET	50009	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.234352112 CET	50010	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.471982002 CET	19354	50009	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.475914001 CET	19354	50010	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.476104021 CET	50010	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.477025986 CET	50010	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.717340946 CET	19354	50010	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.717381954 CET	19354	50010	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.717437029 CET	50010	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.717459917 CET	50010	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.718087912 CET	19354	50010	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.718426943 CET	50010	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.719422102 CET	50011	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.958651066 CET	19354	50010	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.958669901 CET	19354	50010	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.961050987 CET	19354	50011	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:18.961128950 CET	50011	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:18.962037086 CET	50011	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.202899933 CET	19354	50011	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.202919006 CET	19354	50011	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.203057051 CET	50011	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.203582048 CET	19354	50011	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.205636024 CET	50011	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.207076073 CET	50012	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.444885015 CET	19354	50011	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.450769901 CET	19354	50012	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.450942993 CET	50012	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.451839924 CET	50012	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.694926977 CET	19354	50012	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.694951057 CET	19354	50012	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.695000887 CET	50012	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.695019960 CET	50012	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.695374012 CET	19354	50012	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.695564032 CET	50012	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.696768999 CET	50013	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.938194990 CET	19354	50013	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.938410997 CET	50013	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:19.938607931 CET	19354	50012	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.938673973 CET	19354	50012	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:19.939024925 CET	50013	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.180006981 CET	19354	50013	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.180043936 CET	19354	50013	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.180217981 CET	50013	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.180217981 CET	50013	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.180509090 CET	19354	50013	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.194330931 CET	50013	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.195483923 CET	50014	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.421680927 CET	19354	50013	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.421698093 CET	19354	50013	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.439232111 CET	19354	50014	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.439587116 CET	50014	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.575512886 CET	50014	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.683475018 CET	19354	50014	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.683516026 CET	19354	50014	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.683831930 CET	50014	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.684056044 CET	50014	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.685051918 CET	50015	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.819395065 CET	19354	50014	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.926055908 CET	19354	50015	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:20.926279068 CET	50015	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:20.927345037 CET	19354	50014	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:21.167301893 CET	19354	50015	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:21.167321920 CET	19354	50015	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:21.167588949 CET	50015	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:21.543091059 CET	50015	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:21.566922903 CET	50015	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:21.568120956 CET	50016	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:21.783951044 CET	19354	50015	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:21.807451010 CET	19354	50016	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:21.807573080 CET	50016	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:21.897628069 CET	50016	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.047341108 CET	19354	50016	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.047362089 CET	19354	50016	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.047418118 CET	50016	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.051028967 CET	50016	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.053659916 CET	50016	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.054735899 CET	50017	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.136878014 CET	19354	50016	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.286701918 CET	19354	50016	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.290241003 CET	19354	50016	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.295077085 CET	19354	50017	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.295286894 CET	50017	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.313219070 CET	50017	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.536005020 CET	19354	50017	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.536026001 CET	19354	50017	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.536264896 CET	50017	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.537971973 CET	50017	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.539247036 CET	50018	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.553586960 CET	19354	50017	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.776635885 CET	19354	50017	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.783123016 CET	19354	50018	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:22.783212900 CET	50018	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:22.786928892 CET	50018	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.027100086 CET	19354	50018	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.027134895 CET	19354	50018	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.027394056 CET	50018	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.028440952 CET	50018	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.029721022 CET	50019	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.030771017 CET	19354	50018	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.271073103 CET	19354	50018	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.272975922 CET	19354	50019	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.273180962 CET	50019	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.274007082 CET	50019	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.516314983 CET	19354	50019	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.516359091 CET	19354	50019	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.516431093 CET	50019	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.516463041 CET	50019	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.516823053 CET	19354	50019	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.520661116 CET	50019	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.521886110 CET	50020	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.759331942 CET	19354	50019	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.759390116 CET	19354	50019	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.761115074 CET	19354	50020	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:23.761322021 CET	50020	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:23.762339115 CET	50020	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.000900030 CET	19354	50020	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.000912905 CET	19354	50020	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.001116991 CET	50020	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.001421928 CET	19354	50020	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.005122900 CET	50020	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.006412983 CET	50021	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.240314960 CET	19354	50020	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.245888948 CET	19354	50021	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.245982885 CET	50021	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.247127056 CET	50021	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.485866070 CET	19354	50021	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.485878944 CET	19354	50021	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.486098051 CET	50021	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.486582041 CET	19354	50021	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.486654043 CET	50021	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.487775087 CET	50022	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.725589037 CET	19354	50021	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.730554104 CET	19354	50022	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.730626106 CET	50022	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.731564045 CET	50022	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.973577976 CET	19354	50022	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.973593950 CET	19354	50022	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:24.973825932 CET	50022	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:24.974219084 CET	19354	50022	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.016724110 CET	50022	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.018035889 CET	50023	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.216590881 CET	19354	50022	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.260946035 CET	19354	50023	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.261152029 CET	50023	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.261895895 CET	50023	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.504388094 CET	19354	50023	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.504400969 CET	19354	50023	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.504622936 CET	50023	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.504878998 CET	19354	50023	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.506099939 CET	50023	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.507339001 CET	50024	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.747725010 CET	19354	50023	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.747740030 CET	19354	50024	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.747927904 CET	50024	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.751102924 CET	50024	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.988437891 CET	19354	50024	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.988451958 CET	19354	50024	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:25.988528967 CET	50024	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.988857985 CET	50024	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.989867926 CET	50025	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:25.993174076 CET	19354	50024	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.228878021 CET	19354	50024	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.229948997 CET	19354	50025	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.230043888 CET	50025	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:26.230593920 CET	50025	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:26.469926119 CET	19354	50025	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.469940901 CET	19354	50025	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.469978094 CET	50025	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:26.470020056 CET	50025	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:26.470155954 CET	19354	50025	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.470371008 CET	50025	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:26.471421003 CET	50026	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:26.709770918 CET	19354	50025	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.709800959 CET	19354	50025	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.715791941 CET	19354	50026	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.715975046 CET	50026	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:26.716615915 CET	50026	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:26.960489035 CET	19354	50026	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.960517883 CET	19354	50026	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:26.960594893 CET	50026	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:26.960887909 CET	19354	50026	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.011981964 CET	50026	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.013089895 CET	50027	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.204920053 CET	19354	50026	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.254409075 CET	19354	50027	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.254498005 CET	50027	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.255012989 CET	50027	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.496125937 CET	19354	50027	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.496141911 CET	19354	50027	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.496151924 CET	19354	50027	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.496244907 CET	50027	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.498456955 CET	50027	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.499558926 CET	50028	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.737503052 CET	19354	50027	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.744673967 CET	19354	50028	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.744741917 CET	50028	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.745382071 CET	50028	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.990180969 CET	19354	50028	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.990192890 CET	19354	50028	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.990272999 CET	50028	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.990376949 CET	19354	50028	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:27.990714073 CET	50028	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:27.991869926 CET	50029	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.229022026 CET	19354	50029	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.229139090 CET	50029	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.229768991 CET	50029	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.235378027 CET	19354	50028	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.466579914 CET	19354	50029	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.466747999 CET	19354	50029	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.466774940 CET	19354	50029	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.466902018 CET	50029	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.467015982 CET	50029	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.467737913 CET	50029	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.468707085 CET	50030	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.704174995 CET	19354	50029	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.704205990 CET	19354	50029	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.711337090 CET	19354	50030	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.711433887 CET	50030	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.712066889 CET	50030	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.954350948 CET	19354	50030	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.954364061 CET	19354	50030	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.954437017 CET	50030	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.954626083 CET	19354	50030	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:28.959455013 CET	50030	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:28.962723017 CET	50031	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.197207928 CET	19354	50030	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.203916073 CET	19354	50031	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.203991890 CET	50031	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.206057072 CET	50031	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.445458889 CET	19354	50031	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.445488930 CET	19354	50031	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.445786953 CET	50031	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.446018934 CET	50031	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.447037935 CET	50032	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.447227955 CET	19354	50031	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.687110901 CET	19354	50031	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.687618971 CET	19354	50032	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.687700033 CET	50032	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.691730022 CET	50032	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.928647995 CET	19354	50032	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.928659916 CET	19354	50032	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.928847075 CET	50032	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.930002928 CET	50032	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:29.932334900 CET	19354	50032	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:29.932715893 CET	50033	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.169457912 CET	19354	50032	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.174479008 CET	19354	50033	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.174669981 CET	50033	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.175204039 CET	50033	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.416543007 CET	19354	50033	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.416573048 CET	19354	50033	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.416671991 CET	50033	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.417000055 CET	19354	50033	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.419337034 CET	50033	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.420427084 CET	50034	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.658524990 CET	19354	50034	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.658545017 CET	19354	50033	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.658742905 CET	50034	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.660871983 CET	50034	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.896943092 CET	19354	50034	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.897052050 CET	50034	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.897180080 CET	19354	50034	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.897233009 CET	50034	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.898144007 CET	50034	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:30.898829937 CET	19354	50034	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:30.899431944 CET	50035	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.135237932 CET	19354	50034	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.135251045 CET	19354	50034	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.139434099 CET	19354	50035	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.139520884 CET	50035	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.140225887 CET	50035	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.379751921 CET	19354	50035	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.379780054 CET	19354	50035	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.380007982 CET	50035	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.380143881 CET	19354	50035	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.383220911 CET	50035	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.384213924 CET	50036	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.619925976 CET	19354	50035	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.626189947 CET	19354	50036	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.626307964 CET	50036	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.626775980 CET	50036	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.868668079 CET	19354	50036	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.868696928 CET	19354	50036	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.868701935 CET	19354	50036	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:31.869023085 CET	50036	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.872458935 CET	50036	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:31.873488903 CET	50037	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.110987902 CET	19354	50036	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:32.115356922 CET	19354	50037	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:32.115434885 CET	50037	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.119236946 CET	50037	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.357554913 CET	19354	50037	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:32.357584953 CET	19354	50037	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:32.357774019 CET	50037	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.358778954 CET	50037	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.359852076 CET	50038	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.361121893 CET	19354	50037	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:32.599737883 CET	19354	50037	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:32.603220940 CET	19354	50038	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:32.603543043 CET	50038	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.609416008 CET	50038	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.847050905 CET	19354	50038	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:32.847083092 CET	19354	50038	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:32.847377062 CET	50038	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.847573996 CET	50038	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.848536968 CET	50039	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:32.852633953 CET	19354	50038	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.090539932 CET	19354	50038	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.092848063 CET	19354	50039	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.092930079 CET	50039	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:33.093585014 CET	50039	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:33.338419914 CET	19354	50039	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.338454008 CET	19354	50039	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.338541031 CET	50039	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:33.338659048 CET	19354	50039	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.340903997 CET	50039	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:33.342021942 CET	50040	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:33.582915068 CET	19354	50039	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.584666967 CET	19354	50040	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.584745884 CET	50040	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:33.587063074 CET	50040	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:33.829860926 CET	19354	50040	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.829919100 CET	50040	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:33.837867022 CET	19354	50040	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.837907076 CET	19354	50040	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:33.842541933 CET	50041	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.072746992 CET	19354	50040	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.082686901 CET	19354	50041	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.082786083 CET	50041	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.083405018 CET	50041	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.322935104 CET	19354	50041	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.322969913 CET	19354	50041	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.323024988 CET	50041	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.323070049 CET	50041	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.323227882 CET	19354	50041	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.327898026 CET	50041	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.329024076 CET	50042	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.563028097 CET	19354	50041	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.563062906 CET	19354	50041	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.573520899 CET	19354	50042	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.573622942 CET	50042	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.574204922 CET	50042	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.817933083 CET	19354	50042	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.817948103 CET	19354	50042	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.818032980 CET	50042	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.818269968 CET	19354	50042	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:34.819255114 CET	50042	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:34.820271015 CET	50043	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.063570023 CET	19354	50042	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.064320087 CET	19354	50043	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.064394951 CET	50043	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.064965010 CET	50043	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.307832956 CET	19354	50043	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.307861090 CET	19354	50043	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.308067083 CET	50043	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.308115959 CET	19354	50043	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.308315039 CET	50043	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.309372902 CET	50044	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.550095081 CET	19354	50044	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.550173998 CET	50044	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.550765038 CET	50044	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.551078081 CET	19354	50043	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.791171074 CET	19354	50044	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.791202068 CET	19354	50044	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.791284084 CET	50044	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.791305065 CET	19354	50044	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:35.794240952 CET	50044	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:35.795665979 CET	50045	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.031910896 CET	19354	50044	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.038702011 CET	19354	50045	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.038824081 CET	50045	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.039233923 CET	50045	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.282222033 CET	19354	50045	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.282234907 CET	19354	50045	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.282247066 CET	19354	50045	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.282305956 CET	50045	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.282306910 CET	50045	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.282598019 CET	50045	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.284041882 CET	50046	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.523799896 CET	19354	50046	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.524002075 CET	50046	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.524653912 CET	50046	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.525278091 CET	19354	50045	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.525321007 CET	19354	50045	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.763823032 CET	19354	50046	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.763854980 CET	19354	50046	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.764055967 CET	50046	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.764231920 CET	19354	50046	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:36.765279055 CET	50046	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:36.766360998 CET	50047	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.003846884 CET	19354	50046	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.009897947 CET	19354	50047	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.009994030 CET	50047	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.016103029 CET	50047	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.254045010 CET	19354	50047	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.254080057 CET	19354	50047	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.254318953 CET	50047	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.254728079 CET	50047	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.255780935 CET	50048	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.259634972 CET	19354	50047	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.496006966 CET	19354	50048	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.496090889 CET	50048	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.496686935 CET	50048	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.497912884 CET	19354	50047	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.736502886 CET	19354	50048	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.736515999 CET	19354	50048	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.736712933 CET	50048	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.737036943 CET	19354	50048	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.739377975 CET	50048	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.740266085 CET	50049	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:37.977365017 CET	19354	50048	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.981758118 CET	19354	50049	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:37.981853008 CET	50049	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.002839088 CET	50049	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.223490953 CET	19354	50049	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.223516941 CET	19354	50049	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.223716021 CET	50049	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.223716021 CET	50049	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.225457907 CET	50049	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.226466894 CET	50050	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.244304895 CET	19354	50049	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.465434074 CET	19354	50049	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.465450048 CET	19354	50049	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.467881918 CET	19354	50050	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.467971087 CET	50050	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.576097965 CET	50050	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.709867001 CET	19354	50050	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.709881067 CET	19354	50050	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.709976912 CET	50050	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.725617886 CET	50050	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.726550102 CET	50051	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:38.817673922 CET	19354	50050	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.951389074 CET	19354	50050	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.972310066 CET	19354	50051	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:38.972498894 CET	50051	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:39.218055010 CET	19354	50051	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:39.218069077 CET	19354	50051	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:39.218220949 CET	50051	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:39.525799990 CET	50051	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:39.532953024 CET	50051	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:39.533988953 CET	50052	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:39.771447897 CET	19354	50051	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:39.773436069 CET	19354	50052	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:39.773627043 CET	50052	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:39.896763086 CET	50052	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.013298988 CET	19354	50052	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.013329983 CET	19354	50052	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.013511896 CET	50052	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.022378922 CET	50052	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.023462057 CET	50053	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.136115074 CET	19354	50052	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.252947092 CET	19354	50052	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.266055107 CET	19354	50053	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.266288042 CET	50053	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.266642094 CET	50053	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.508789062 CET	19354	50053	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.508817911 CET	19354	50053	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.508888960 CET	19354	50053	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.509000063 CET	50053	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.518631935 CET	50053	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.532942057 CET	50054	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.751420021 CET	19354	50053	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.774456024 CET	19354	50054	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:40.774564981 CET	50054	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:40.775183916 CET	50054	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.016328096 CET	19354	50054	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.016340017 CET	19354	50054	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.016431093 CET	50054	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.016474962 CET	19354	50054	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.017429113 CET	50054	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.018342972 CET	50055	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.258151054 CET	19354	50054	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.260942936 CET	19354	50055	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.261055946 CET	50055	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.261759996 CET	50055	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.503875017 CET	19354	50055	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.503907919 CET	19354	50055	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.504089117 CET	50055	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.504089117 CET	50055	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.504304886 CET	50055	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.504312992 CET	19354	50055	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.505315065 CET	50056	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.746543884 CET	19354	50055	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.746592045 CET	19354	50055	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.747750044 CET	19354	50056	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.747823954 CET	50056	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.748672009 CET	50056	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.990781069 CET	19354	50056	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.990808010 CET	19354	50056	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.990890980 CET	50056	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.991089106 CET	19354	50056	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:41.992356062 CET	50056	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:41.994766951 CET	50057	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.233360052 CET	19354	50056	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.240442991 CET	19354	50057	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.240590096 CET	50057	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.242902040 CET	50057	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.486644983 CET	19354	50057	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.486676931 CET	19354	50057	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.486869097 CET	50057	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.487349987 CET	50057	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.488281012 CET	50058	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.488488913 CET	19354	50057	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.730798960 CET	19354	50058	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.730882883 CET	50058	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.731333971 CET	50058	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.732608080 CET	19354	50057	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.973568916 CET	19354	50058	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.973582029 CET	19354	50058	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.973648071 CET	50058	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.973721981 CET	19354	50058	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:42.975178957 CET	50058	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:42.976217031 CET	50059	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:43.216206074 CET	19354	50058	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:43.221071959 CET	19354	50059	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:43.221143007 CET	50059	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:43.221744061 CET	50059	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:43.466169119 CET	19354	50059	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:43.466197014 CET	19354	50059	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:43.466411114 CET	50059	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:43.466438055 CET	19354	50059	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:43.468209982 CET	50059	19354	192.168.2.4	3.126.37.18
Dec 30, 2023 07:00:43.593972921 CET	50060	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:43.711163998 CET	19354	50059	3.126.37.18	192.168.2.4
Dec 30, 2023 07:00:43.833431005 CET	19354	50060	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:43.833554983 CET	50060	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:43.834105968 CET	50060	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.073302031 CET	19354	50060	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.073331118 CET	19354	50060	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.073502064 CET	19354	50060	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.073545933 CET	50060	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.074990034 CET	50060	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.075923920 CET	50061	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.313014984 CET	19354	50060	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.319701910 CET	19354	50061	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.319777012 CET	50061	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.320331097 CET	50061	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.563719034 CET	19354	50061	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.563750982 CET	19354	50061	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.563844919 CET	50061	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.564038038 CET	19354	50061	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.567394018 CET	50061	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.568399906 CET	50062	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.807595015 CET	19354	50061	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.811083078 CET	19354	50062	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:44.811167002 CET	50062	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:44.811641932 CET	50062	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.053920984 CET	19354	50062	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.053932905 CET	19354	50062	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.053977013 CET	50062	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.053997993 CET	50062	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.054059029 CET	19354	50062	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.056648970 CET	50062	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.057857037 CET	50063	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.296559095 CET	19354	50062	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.296744108 CET	19354	50062	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.298913002 CET	19354	50063	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.298985958 CET	50063	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.301340103 CET	50063	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.540329933 CET	19354	50063	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.540358067 CET	19354	50063	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.540599108 CET	50063	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.541831970 CET	50063	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.542346001 CET	19354	50063	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.548405886 CET	50064	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.781703949 CET	19354	50063	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.792049885 CET	19354	50064	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:45.792239904 CET	50064	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:45.792624950 CET	50064	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.036096096 CET	19354	50064	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.036109924 CET	19354	50064	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.036122084 CET	19354	50064	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.036166906 CET	50064	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.036186934 CET	50064	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.036969900 CET	50064	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.044394016 CET	50065	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.279750109 CET	19354	50064	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.279764891 CET	19354	50064	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.283649921 CET	19354	50065	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.283720970 CET	50065	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.284271002 CET	50065	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.523190975 CET	19354	50065	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.523250103 CET	19354	50065	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.523305893 CET	50065	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.523329973 CET	50065	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.523529053 CET	19354	50065	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.524523973 CET	50065	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.525566101 CET	50066	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.762700081 CET	19354	50065	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.762716055 CET	19354	50065	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.770261049 CET	19354	50066	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:46.770337105 CET	50066	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:46.770843029 CET	50066	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.015429020 CET	19354	50066	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.015458107 CET	19354	50066	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.015517950 CET	19354	50066	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.015522957 CET	50066	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.015826941 CET	50066	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.016736031 CET	50067	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.256055117 CET	19354	50067	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.256136894 CET	50067	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.256829023 CET	50067	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.260221004 CET	19354	50066	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.495579958 CET	19354	50067	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.495593071 CET	19354	50067	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.495786905 CET	50067	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.496082067 CET	19354	50067	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.496561050 CET	50067	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.497658968 CET	50068	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.735040903 CET	19354	50067	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.739947081 CET	19354	50068	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.740014076 CET	50068	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.740606070 CET	50068	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.982510090 CET	19354	50068	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.982534885 CET	19354	50068	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.982577085 CET	50068	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.982605934 CET	50068	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.982820034 CET	19354	50068	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:47.983409882 CET	50068	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:47.984386921 CET	50069	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.224937916 CET	19354	50068	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.224948883 CET	19354	50068	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.226831913 CET	19354	50069	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.227025986 CET	50069	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.227391958 CET	50069	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.469744921 CET	19354	50069	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.469757080 CET	19354	50069	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.469820976 CET	50069	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.469861031 CET	19354	50069	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.473902941 CET	50069	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.474955082 CET	50070	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.712455034 CET	19354	50069	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.714590073 CET	19354	50070	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.714659929 CET	50070	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.719327927 CET	50070	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.954694986 CET	19354	50070	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.954838037 CET	19354	50070	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:48.954922915 CET	50070	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.954922915 CET	50070	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.956615925 CET	50070	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.957659960 CET	50071	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:48.958935976 CET	19354	50070	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.194788933 CET	19354	50070	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.194818020 CET	19354	50070	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.200376034 CET	19354	50071	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.200592995 CET	50071	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.200939894 CET	50071	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.443455935 CET	19354	50071	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.443471909 CET	19354	50071	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.443559885 CET	19354	50071	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.443578005 CET	50071	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.446157932 CET	50071	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.451450109 CET	50072	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.686383963 CET	19354	50071	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.694107056 CET	19354	50072	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.694324017 CET	50072	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.694788933 CET	50072	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.937191010 CET	19354	50072	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.937221050 CET	19354	50072	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.937293053 CET	50072	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.937294006 CET	50072	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.937433958 CET	19354	50072	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:49.937894106 CET	50072	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:49.941781044 CET	50073	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.180159092 CET	19354	50072	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.180172920 CET	19354	50072	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.186105013 CET	19354	50073	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.186193943 CET	50073	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.186981916 CET	50073	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.430707932 CET	19354	50073	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.430737019 CET	19354	50073	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.430939913 CET	50073	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.431236982 CET	19354	50073	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.434045076 CET	50073	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.435023069 CET	50074	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.675470114 CET	19354	50073	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.681616068 CET	19354	50074	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.681804895 CET	50074	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.682276964 CET	50074	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.928491116 CET	19354	50074	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.928507090 CET	19354	50074	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.928579092 CET	19354	50074	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:50.928621054 CET	50074	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.929243088 CET	50074	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:50.930138111 CET	50075	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.175182104 CET	19354	50074	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.176445007 CET	19354	50075	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.176513910 CET	50075	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.177057028 CET	50075	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.423062086 CET	19354	50075	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.423079967 CET	19354	50075	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.423156023 CET	50075	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.423249960 CET	19354	50075	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.424501896 CET	50075	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.425518036 CET	50076	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.669677019 CET	19354	50075	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.669709921 CET	19354	50076	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.669800043 CET	50076	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.670270920 CET	50076	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.914130926 CET	19354	50076	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.914143085 CET	19354	50076	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.914151907 CET	19354	50076	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:51.914233923 CET	50076	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.920305967 CET	50076	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:51.942915916 CET	50077	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.158199072 CET	19354	50076	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.186157942 CET	19354	50077	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.186228037 CET	50077	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.186665058 CET	50077	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.429701090 CET	19354	50077	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.429714918 CET	19354	50077	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.429765940 CET	50077	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.429927111 CET	19354	50077	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.444221020 CET	50077	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.445276976 CET	50078	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.672988892 CET	19354	50077	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.683437109 CET	19354	50078	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.683535099 CET	50078	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.683986902 CET	50078	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.921837091 CET	19354	50078	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.921852112 CET	19354	50078	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.921914101 CET	50078	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.922178984 CET	19354	50078	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:52.935414076 CET	50078	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:52.936475039 CET	50079	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.159993887 CET	19354	50078	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.176635027 CET	19354	50079	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.176732063 CET	50079	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.177189112 CET	50079	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.417042971 CET	19354	50079	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.417072058 CET	19354	50079	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.417118073 CET	50079	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.417157888 CET	50079	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.417332888 CET	19354	50079	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.417572021 CET	50079	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.418536901 CET	50080	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.657073021 CET	19354	50079	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.657105923 CET	19354	50079	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.664498091 CET	19354	50080	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.664589882 CET	50080	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.665143967 CET	50080	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.911096096 CET	19354	50080	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.911128044 CET	19354	50080	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.911138058 CET	19354	50080	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:53.911195040 CET	50080	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.911626101 CET	50080	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:53.912499905 CET	50081	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:54.153690100 CET	19354	50081	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:54.153788090 CET	50081	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:54.154301882 CET	50081	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:54.157248020 CET	19354	50080	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:54.395221949 CET	19354	50081	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:54.395256042 CET	19354	50081	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:54.395315886 CET	50081	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:54.395318985 CET	19354	50081	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:54.636502028 CET	19354	50081	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:57.751872063 CET	50082	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:57.990318060 CET	19354	50082	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:57.990466118 CET	50082	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:57.990896940 CET	50082	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:58.229007959 CET	19354	50082	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:58.229074001 CET	50082	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:58.229155064 CET	19354	50082	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:58.229166985 CET	19354	50082	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:58.229212046 CET	50082	19354	192.168.2.4	18.197.239.5
Dec 30, 2023 07:00:58.467374086 CET	19354	50082	18.197.239.5	192.168.2.4
Dec 30, 2023 07:00:58.467422962 CET	19354	50082	18.197.239.5	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2023 06:56:55.315988064 CET	59416	53	192.168.2.4	1.1.1.1
Dec 30, 2023 06:56:55.461504936 CET	53	59416	1.1.1.1	192.168.2.4
Dec 30, 2023 06:57:56.152983904 CET	58115	53	192.168.2.4	1.1.1.1
Dec 30, 2023 06:57:56.297986031 CET	53	58115	1.1.1.1	192.168.2.4
Dec 30, 2023 06:58:55.476154089 CET	61262	53	192.168.2.4	1.1.1.1
Dec 30, 2023 06:58:55.600205898 CET	53	61262	1.1.1.1	192.168.2.4
Dec 30, 2023 06:59:55.515933990 CET	51817	53	192.168.2.4	1.1.1.1
Dec 30, 2023 06:59:55.638200045 CET	53	51817	1.1.1.1	192.168.2.4
Dec 30, 2023 07:00:43.468978882 CET	52580	53	192.168.2.4	1.1.1.1
Dec 30, 2023 07:00:43.593019962 CET	53	52580	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2023 06:56:55.315988064 CET	192.168.2.4	1.1.1.1	0x178b	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 30, 2023 06:57:56.152983904 CET	192.168.2.4	1.1.1.1	0x9da4	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 30, 2023 06:58:55.476154089 CET	192.168.2.4	1.1.1.1	0x1a93	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 30, 2023 06:59:55.515933990 CET	192.168.2.4	1.1.1.1	0x6a5e	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Dec 30, 2023 07:00:43.468978882 CET	192.168.2.4	1.1.1.1	0x1e57	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 30, 2023 06:56:55.461504936 CET	1.1.1.1	192.168.2.4	0x178b	No error (0)	2.tcp.eu.ngrok.io	3.127.138.57	A (IP address)	IN (0x0001)	false
Dec 30, 2023 06:57:56.297986031 CET	1.1.1.1	192.168.2.4	0x9da4	No error (0)	2.tcp.eu.ngrok.io	18.156.13.209	A (IP address)	IN (0x0001)	false
Dec 30, 2023 06:58:55.600205898 CET	1.1.1.1	192.168.2.4	0x1a93	No error (0)	2.tcp.eu.ngrok.io	3.127.138.57	A (IP address)	IN (0x0001)	false
Dec 30, 2023 06:59:55.638200045 CET	1.1.1.1	192.168.2.4	0x6a5e	No error (0)	2.tcp.eu.ngrok.io	3.126.37.18	A (IP address)	IN (0x0001)	false
Dec 30, 2023 07:00:43.593019962 CET	1.1.1.1	192.168.2.4	0x1e57	No error (0)	2.tcp.eu.ngrok.io	18.197.239.5	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	06:56:48
Start date:	30/12/2023
Path:	C:\Users\user\Desktop\tiodtk2cfy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\tiodtk2cfy.exe
Imagebase:	0x470000
File size:	95'232 bytes
MD5 hash:	B56BE916B1CA250CD9FE04B283E0C3EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000002.1630097952.0000000003A68000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1609537761.0000000000472000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:56:50
Start date:	30/12/2023
Path:	C:\Users\user\AppData\Roaming\server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\server.exe"
Imagebase:	0x60000
File size:	95'232 bytes
MD5 hash:	B56BE916B1CA250CD9FE04B283E0C3EE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000001.00000002.4063644018.00000000026E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\server.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\server.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\server.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\server.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\server.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs Detection: 82%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:56:51
Start date:	30/12/2023
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\AppData\Roaming\server.exe" "server.exe" ENABLE
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:56:51
Start date:	30/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	06:57:14
Start date:	30/12/2023
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe"
Imagebase:	0x350000
File size:	95'232 bytes
MD5 hash:	B56BE916B1CA250CD9FE04B283E0C3EE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs Detection: 82%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	58
Total number of Limit Nodes:	4

Executed Functions

Function 04C44298 Relevance: 4.4, Strings: 2, Instructions: 1950
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 04C44C24
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: @$Yk^
API String ID: 0-61571821
Opcode ID: 849768fb43dfff60c999ba1d36f30a682ef0c8df789cc6d3dac09b5ad52be94a
Instruction ID: 14e7b086f88f8f7299c7b3a0b24d7cbbd14e791807e7b26f896dc9bd3e64e18f
Opcode Fuzzy Hash: 849768fb43dfff60c999ba1d36f30a682ef0c8df789cc6d3dac09b5ad52be94a
Instruction Fuzzy Hash: 31233A74A01228CFDB25EF74D954BA9B7B2FB88304F1041EAD90967395DB399E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C44269 Relevance: 4.3, Strings: 2, Instructions: 1757
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: 5df949228deffe8dfddb48f669f8832ee3ea8761183c35a86f9446df9c8deb06
Instruction ID: 583ae55f705f3ea53755a739a61d5815c410be6b96f28752d049e9869e753a40
Opcode Fuzzy Hash: 5df949228deffe8dfddb48f669f8832ee3ea8761183c35a86f9446df9c8deb06
Instruction Fuzzy Hash: A7134C74A01228CFDB25EF34D954BA9BBB2FB89304F1041EAD90967395DB359E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C400B8 Relevance: 2.6, Strings: 2, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5]k^, xrefs: 04C40194, 04C40199
E]k^, xrefs: 04C40140, 04C40145

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: 5]k^$E]k^
API String ID: 0-3693904655
Opcode ID: e32f6a9d44ea53dfd5d7ca8d91bd38b06b4ce31e664aafbf16a8a46e512b4c93
Instruction ID: 2721446060adaa3ec589d6119c63b8b282e4b348f49c43e210c0a1d164bb6aab
Opcode Fuzzy Hash: e32f6a9d44ea53dfd5d7ca8d91bd38b06b4ce31e664aafbf16a8a46e512b4c93
Instruction Fuzzy Hash: E83124326042409FCB15AB759852B6E3BB79BC2358F1584AED001CB2D2CFB95C068792

Uniqueness

Uniqueness Score: -1.00%

Function 04C40118 Relevance: 2.6, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

5]k^, xrefs: 04C40194, 04C40199
E]k^, xrefs: 04C40140, 04C40145

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: 5]k^$E]k^
API String ID: 0-3693904655
Opcode ID: bdc020832ed72540ace655305a208d6b56c51fd9199f2f09dd4154e3efda4ccb
Instruction ID: 8930eb512f414461eb987b38867412b46f102702172f707da1d490bd91d7f8b6
Opcode Fuzzy Hash: bdc020832ed72540ace655305a208d6b56c51fd9199f2f09dd4154e3efda4ccb
Instruction Fuzzy Hash: 391129727011408FCB25E779A55177D2BABDBC2348B15447EC002CB792CFB95C0B8792

Uniqueness

Uniqueness Score: -1.00%

Function 00A5AA75 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00A5AB25

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b38f9b9a100422a72160a2b9647f0d58df78e7ef32c28ecdd9cc849179517df0
Instruction ID: 9a706c052e3359326fc0875e414959e5321b8557724b725ceab5aa77b3e13a6b
Opcode Fuzzy Hash: b38f9b9a100422a72160a2b9647f0d58df78e7ef32c28ecdd9cc849179517df0
Instruction Fuzzy Hash: 7A319071505380AFE722CF25CC44B52BBF8EF06310F08899AE9858B652D375E909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A5B036 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00A5B0DD

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 1acdb43570f8a573ffdcfa8ced86e8cdc98b80003b12b274b763dcbeba265aff
Instruction ID: e50264641bc7ac02efb1db7a0d2209d15d05c3d5663df7e456a6ed58f11019b9
Opcode Fuzzy Hash: 1acdb43570f8a573ffdcfa8ced86e8cdc98b80003b12b274b763dcbeba265aff
Instruction Fuzzy Hash: 5E31A1B15097805FE722CB25DC45B96FFF8EF06310F08849AE984CB692D375A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A6CE Relevance: 1.6, APIs: 1, Instructions: 85
comclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 00A5A77E

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: 3869b9317a3b817367c0c80b4e42399f584241b59dd7fe07e2b323782247c666
Instruction ID: 44a325ee883ede76cb4df2c92735f4731756dae757570e64b4347822f6777ae3
Opcode Fuzzy Hash: 3869b9317a3b817367c0c80b4e42399f584241b59dd7fe07e2b323782247c666
Instruction Fuzzy Hash: F1317E7104E3C06FD3138B259C61B62BFB4EF47610F0A40DBE884CB6A3D2296919D772

Uniqueness

Uniqueness Score: -1.00%

Function 00A5AE77 Relevance: 1.6, APIs: 1, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E24,B2C02E97,00000000,00000000,00000000,00000000), ref: 00A5AF0D

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f98ffcb286c9f19e3115bdd0acdde263087fec6040bc3834cf4e30681b2f42e1
Instruction ID: 42a61a4423031ed34536bca3e6f233b6e666453bdea34053d87ba36afe31848d
Opcode Fuzzy Hash: f98ffcb286c9f19e3115bdd0acdde263087fec6040bc3834cf4e30681b2f42e1
Instruction Fuzzy Hash: 7421D3B2409380AFE722CF51DD44F96BFB8EF06314F08849AE9849B552D234A90DCB71

Uniqueness

Uniqueness Score: -1.00%

Function 00A5AAA6 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00A5AB25

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f788872add61d2c52261bcb02f41976d72a5eec9656c83e2c4ea6321a930ae4c
Instruction ID: 2935742ca5bf8fd4367a4e417e63252c48518f80648c8342c8f90e11e90b57cb
Opcode Fuzzy Hash: f788872add61d2c52261bcb02f41976d72a5eec9656c83e2c4ea6321a930ae4c
Instruction Fuzzy Hash: 7E21AE71600200AFEB21CF65DD45B66FBE8FF18314F04896AED458BA51D375E908CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00A5AC37 Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E24,B2C02E97,00000000,00000000,00000000,00000000), ref: 00A5ACBD

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 4523c49c2e276a6c387c51922777f9194469ade96025897c1ca171bd271c752f
Instruction ID: 769b4bfbd4039fe8fddd94fb234732c295884bf7d733d91860413f057c8e2da5
Opcode Fuzzy Hash: 4523c49c2e276a6c387c51922777f9194469ade96025897c1ca171bd271c752f
Instruction Fuzzy Hash: 4E21F6B54093806FE7128B51DC40BA2BFB8EF46714F0884D6E9848B653C268A909D772

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A9BF Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(?), ref: 00A5AA44

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: e6a756278d0007e173744e5bc5c87a4e2c8c7ae7392da6670fb54f21ec22cae8
Instruction ID: feeca3c81035c349cd09a52acc150cbda894179639a33f55405fa19b6bd17369
Opcode Fuzzy Hash: e6a756278d0007e173744e5bc5c87a4e2c8c7ae7392da6670fb54f21ec22cae8
Instruction Fuzzy Hash: 8121486550E3C09FD7138B259C64A52BFB4AF53624F0E81DBD9848F6A3C268580DCB73

Uniqueness

Uniqueness Score: -1.00%

Function 00A5B06A Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00A5B0DD

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 3eb53f825bf1d74899bb6031d4c621bc443a2b8d741f90d6366e2c5a6251ec90
Instruction ID: b9dc8b7e87be2d5fefd85d891315b447be781158e744f6ff8654d2e066e7575f
Opcode Fuzzy Hash: 3eb53f825bf1d74899bb6031d4c621bc443a2b8d741f90d6366e2c5a6251ec90
Instruction Fuzzy Hash: 802192716012409FE720DF25DD45BA6FBE8EF04325F04886AED458B781D775E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00A5AB7C Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00A5ABF0

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8a3400a76ea71077c011da2a33d449928a50633b91d336d413ddf179256524ef
Instruction ID: 7daeec18da1e3cf14a6cd1ad2a86559d115cc7e703116d7a40c07634dd25bbb1
Opcode Fuzzy Hash: 8a3400a76ea71077c011da2a33d449928a50633b91d336d413ddf179256524ef
Instruction Fuzzy Hash: EA21A1B55097C09FDB128B25EC95752BFB8EF16320F0984DBDC858B6A3D2359908C762

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A61E Relevance: 1.6, APIs: 1, Instructions: 65
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(?), ref: 00A5A690

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 889c488ccaf9b0881a2707ab2171cbf153417d90a3c60d90db36f987346ed15a
Instruction ID: 6a68bfa6dc4c677b96623896222b089690380fb03be3a0556cb42255510948bf
Opcode Fuzzy Hash: 889c488ccaf9b0881a2707ab2171cbf153417d90a3c60d90db36f987346ed15a
Instruction Fuzzy Hash: FF21277150E3C09FDB138B25DC94652BFB4AF17224F0984DBD9848F6A3D2699908DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A573 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A5A5DE

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a7d5366cfb33e52d477d42a3e6ae3345223a48938ab4860940671136343f6472
Instruction ID: 9aeb030f0b32657c605d35d6be3df25b7cae091bc15094369d57cf088dbdd222
Opcode Fuzzy Hash: a7d5366cfb33e52d477d42a3e6ae3345223a48938ab4860940671136343f6472
Instruction Fuzzy Hash: B3118471509780AFDB228F51DC44A62FFF4EF4A310F0889DAED858B562C275A918DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A5B424 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00A5B480

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 2a7985f7fc04a25e32c6cc32780e6cf1ecd147d375e75893963859ff87a89928
Instruction ID: 37397ffbead2292382c54360dd4e858e13b3dc0277bdae64e72335d281a8a4e0
Opcode Fuzzy Hash: 2a7985f7fc04a25e32c6cc32780e6cf1ecd147d375e75893963859ff87a89928
Instruction Fuzzy Hash: DC1160715093809FDB12CF25DC94B52BFB8EF46225F0884EBED85CB653D275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A5AEAE Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E24,B2C02E97,00000000,00000000,00000000,00000000), ref: 00A5AF0D

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 0996454757bf05f8069936d62fecacab0af716c3515b75ad2e6a448609389903
Instruction ID: a88153e71c9ed632ba338e3ec0421e17ffcee05cffef93d6faab6d240f429a6a
Opcode Fuzzy Hash: 0996454757bf05f8069936d62fecacab0af716c3515b75ad2e6a448609389903
Instruction Fuzzy Hash: 6F11E271600300AFEB218F55DD44BA6FBE8EF14714F04C86AED458BA41C334A50C8BB2

Uniqueness

Uniqueness Score: -1.00%

Function 00A5AC6A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,B2C02E97,00000000,00000000,00000000,00000000), ref: 00A5ACBD

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 9136e03c5345c9f58ff5bb7c86b9feb0340aa36177520ea69e71e5c5a3ff1165
Instruction ID: 2b8f6c24d5acaa8636b5d87d031b68c4353472443abae5be9bea7ede524abf17
Opcode Fuzzy Hash: 9136e03c5345c9f58ff5bb7c86b9feb0340aa36177520ea69e71e5c5a3ff1165
Instruction Fuzzy Hash: 5D010071600300AFE7208B45DD84BA6FBA8EF14725F04C4A6ED048BB41C678A80C8AA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A5B446 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00A5B480

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: db52f8724b74b3ac44be40270330714a849bb11661e664d5bc113f2b3e8395d7
Instruction ID: 6dd0ecec80d16563e807cadf5e166672b9056a21017f44ecd365ecd4fc50e610
Opcode Fuzzy Hash: db52f8724b74b3ac44be40270330714a849bb11661e664d5bc113f2b3e8395d7
Instruction Fuzzy Hash: 330180716002408FDB20CF19D984766FBE8EF04726F08C4AADD49CBA52D778E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A59A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A5A5DE

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f15038c83580c13ddf778806a19dea71445b5102b6518d05659661d224502544
Instruction ID: 35fb084ca288a99497c36023de96a744816ff8250daf5cdf64af2cd28b62388e
Opcode Fuzzy Hash: f15038c83580c13ddf778806a19dea71445b5102b6518d05659661d224502544
Instruction Fuzzy Hash: E5018B725006009FDB218F55D944B62FFE0EF08321F0889AADE894BA11D236A418DF62

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A72E Relevance: 1.5, APIs: 1, Instructions: 43comclipboardCOMMON

Download Yara Rule

APIs

OleGetClipboard.OLE32(?,00000E24,?,?), ref: 00A5A77E

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: Clipboard
String ID:
API String ID: 220874293-0
Opcode ID: a1820f20c08128d681d055f8bc710c875f3fa172c594f50bc0854d9ed8f37d66
Instruction ID: 0bd57ab441f0b02aa17a9f28a8e1cf853cc45a317692dcdf22c036adfe67049c
Opcode Fuzzy Hash: a1820f20c08128d681d055f8bc710c875f3fa172c594f50bc0854d9ed8f37d66
Instruction Fuzzy Hash: 2001D671500600ABD310DF1ACD46B66FBE8FB88A20F14815AEC089BB41D731F916CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00A5ABBE Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00A5ABF0

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c78074b97456814c51ca43f13af930c43f809a68ba3a975895b45a7e294c8806
Instruction ID: e29354cbe836e75ec630a44144e155a3d085442bd0e9881c6ec69ac21a53d72b
Opcode Fuzzy Hash: c78074b97456814c51ca43f13af930c43f809a68ba3a975895b45a7e294c8806
Instruction Fuzzy Hash: 5C0184716052408FDB108F55E985766FBE4EF14321F08C4ABDD498FA55D679D808CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00A5A65E Relevance: 1.5, APIs: 1, Instructions: 39comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(?), ref: 00A5A690

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4bf5f1d7835408df3ae75b4e293c98f97c8aa89f54f99f6c3df73db8f9e66e5d
Instruction ID: 0ad8080b7857c37fcaf851bbada004a545f402d0f8dd52091023d143f575ac37
Opcode Fuzzy Hash: 4bf5f1d7835408df3ae75b4e293c98f97c8aa89f54f99f6c3df73db8f9e66e5d
Instruction Fuzzy Hash: 8101AD71A012409FEB20CF15D984766FBE4EF14321F0CC8AADD488FA56D279A408CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A5AA12 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00A5AA44

Memory Dump Source

Source File: 00000000.00000002.1629674739.0000000000A5A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A5A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a5a000_tiodtk2cfy.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 905130a5645cc79899b503a34eacd537882de113a5699d8c0a36405f8a3746cc
Instruction ID: 8a320d2157be844c5ffd4e14cafdabf4c3e33509fe570317d06d31b3f5ffb8e6
Opcode Fuzzy Hash: 905130a5645cc79899b503a34eacd537882de113a5699d8c0a36405f8a3746cc
Instruction Fuzzy Hash: 59F0A4759006409FDB208F05DA84762FBE4EF14725F08C1AADE494BB52D679A508CE62

Uniqueness

Uniqueness Score: -1.00%

Function 04C43801 Relevance: .5, Instructions: 500COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7cde47b30472b8458dcbc4cc5eabd5173fc85be6bdca6c30fe8c56d13577453
Instruction ID: a5a1f74ec94d2b0a4be1206f9d70f2b72219fb3b81363c916b1e7041d775616d
Opcode Fuzzy Hash: d7cde47b30472b8458dcbc4cc5eabd5173fc85be6bdca6c30fe8c56d13577453
Instruction Fuzzy Hash: F4321B30A01218CFDB14EF74D955BEDB7B2EB89304F1045A9D40AAB3A5DB799E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F7026D Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630037707.0000000000F70000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197667299eb7c57d57f95af88d9c091c0befb129adbe43d41a9d3f12020674a4
Instruction ID: b3fe8b562fcb85372df40b24eeb59855a6ad6e5b92afc1fafcecae18e4b1d41d
Opcode Fuzzy Hash: 197667299eb7c57d57f95af88d9c091c0befb129adbe43d41a9d3f12020674a4
Instruction Fuzzy Hash: E2219EA544E3C04FD7138B34AC25291BFB0AE43225B1E81EBC489CF5A3D22D5819D7A3

Uniqueness

Uniqueness Score: -1.00%

Function 04C439BF Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f7e9ad59c072d6c36dfc3c203982f933549a6006b0ebd299d54047d742f5baa
Instruction ID: 270b00e4b2b6c09fd695bb69a6fe4e1b44221a052911f9190147378c6478a283
Opcode Fuzzy Hash: 5f7e9ad59c072d6c36dfc3c203982f933549a6006b0ebd299d54047d742f5baa
Instruction Fuzzy Hash: 96816C30A01258CFDB14EFB4C955BACB7B2EF89308F1045AAD40AAB3A4DB795D85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04C43B18 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdfc16b7270b81a5f8bb2a2b09ae2f3f7be86b8b0b3b0ffb439da96d06803bfa
Instruction ID: 0cc367e9ed64efc8be65ce72aa3390e1104b6fc54b21b37f3c4d8757bdecd139
Opcode Fuzzy Hash: fdfc16b7270b81a5f8bb2a2b09ae2f3f7be86b8b0b3b0ffb439da96d06803bfa
Instruction Fuzzy Hash: B3415C30A002588FDB14DFB9C954BACB7B2FF85308F1045AAD409AB2A5DB795E49CF52

Uniqueness

Uniqueness Score: -1.00%

Function 04C43520 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc9cf79e1c0805e5c13976679a1d69e482c57005448a4b388b9117579dd3558f
Instruction ID: a30ddd03c6b65e2bbaa01d6986fbb9bafb8441d89efeaf6e534ae78aabef3566
Opcode Fuzzy Hash: bc9cf79e1c0805e5c13976679a1d69e482c57005448a4b388b9117579dd3558f
Instruction Fuzzy Hash: AD319030B012118FDB14BBB9D9117BE37ABEB88208F10443AD905977A8DF79AD179BD1

Uniqueness

Uniqueness Score: -1.00%

Function 04C40006 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c41afe93bdb13f1cfeab46019fa48d7715a4492518b3fbbf87dbe3952c66ef8
Instruction ID: 5be8de5e46531adeb4ac37d3bdf676545794e82d5759d285ecc5d6ec6da98a65
Opcode Fuzzy Hash: 1c41afe93bdb13f1cfeab46019fa48d7715a4492518b3fbbf87dbe3952c66ef8
Instruction Fuzzy Hash: 1C1169A540F3C18FDB139B749CA46907FB0AF17208B5A49EBC085CA5A7E29C590FC762

Uniqueness

Uniqueness Score: -1.00%

Function 04C43441 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad126602934a20c145dfb36c2ac37f6e85c3f0b650e741cd31bcf340ebfcb9f
Instruction ID: f885478221228484e96b8de2b6f35a3bf005a37dc4bb7153f85302b36c54e08e
Opcode Fuzzy Hash: dad126602934a20c145dfb36c2ac37f6e85c3f0b650e741cd31bcf340ebfcb9f
Instruction Fuzzy Hash: F50180346062428FC714EB74DA5949C7BF1FF88349B008838E4458B355EA749C0BDB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F705E3 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630037707.0000000000F70000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44f9f54b45476fbb87190734fa6b167b7c78303cd231d672c78d94306a806a06
Instruction ID: 86e3cef5bc610b3e36ae53f254dd37c23e890d44f17cd15cef36cd951ddd75b5
Opcode Fuzzy Hash: 44f9f54b45476fbb87190734fa6b167b7c78303cd231d672c78d94306a806a06
Instruction Fuzzy Hash: C6018BB55097805FD7118B159C41863FFE8EE46620709C59FEC498B652D225A908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 04C400A8 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be43d3add15e0504eb75bf3b454934bef82ae90d60822900c508fc1677ee6390
Instruction ID: 65ad3077d702c14872377946c76aa35c5337a39d1874fd01d6e673d6d35a9f61
Opcode Fuzzy Hash: be43d3add15e0504eb75bf3b454934bef82ae90d60822900c508fc1677ee6390
Instruction Fuzzy Hash: 3EF0C236A05304AFEB149BB08812BAE7B72DF81724F1185AED581DB1E2DA3558418740

Uniqueness

Uniqueness Score: -1.00%

Function 00F70606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630037707.0000000000F70000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f70000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7808fc27e79f5565e9f7cc836d4d77658170dc6ff23804d651da26a064d91cfc
Instruction ID: 23b3165052439fe74acee967d5d62ee722ecaef0807bd2148165df85b2dcc457
Opcode Fuzzy Hash: 7808fc27e79f5565e9f7cc836d4d77658170dc6ff23804d651da26a064d91cfc
Instruction Fuzzy Hash: 99E092B66006404B9650CF0AFC41462FBD8EB88630B08C47FDC0D8BB11D236B508CEA6

Uniqueness

Uniqueness Score: -1.00%

Function 04C436A8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bddc2261fa8232c9003b7af39a49649ba75e259b16eca62a466df378fe5ee686
Instruction ID: 3a06924436d40c7176b40fe777743711bab28ad3a15f363b22424496de8d608a
Opcode Fuzzy Hash: bddc2261fa8232c9003b7af39a49649ba75e259b16eca62a466df378fe5ee686
Instruction Fuzzy Hash: 99E08630107340CFC7265B34A01491C3B71EF47309F5104FDC4468B666D7768446CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00A523F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629663939.0000000000A52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a52000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 058874294d3d6cfef96eb2347926d6cbb684a5074decfd03ff60cfa25200bc61
Instruction ID: c9a5ac4a70c7f36de0bd4edc610005fab0ee2048e0d3426f9b3a36a72a30ba1d
Opcode Fuzzy Hash: 058874294d3d6cfef96eb2347926d6cbb684a5074decfd03ff60cfa25200bc61
Instruction Fuzzy Hash: 2AD02E79240BC04FD3228B0CC2A4B8537E4BB42704F0A04F9AC00CB763C738D984C200

Uniqueness

Uniqueness Score: -1.00%

Function 00A523BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629663939.0000000000A52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a52000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ad04ba5508bd658a100fd15bd2f0dbabb03900f3733c44e0288480b62b4a89
Instruction ID: d14aee287279fb33702cd2138797e43e6d19524b080965ba7e1aee518d8265b5
Opcode Fuzzy Hash: 49ad04ba5508bd658a100fd15bd2f0dbabb03900f3733c44e0288480b62b4a89
Instruction Fuzzy Hash: 74D05E342002814BD725DB0CC2D4F5977D4BB41725F0644F8AC108F762C7B8D8C4DA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04C444F1 Relevance: 4.1, Strings: 2, Instructions: 1624COMMON

Download Yara Rule

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: f8eaa589c78dcd0a7e03446927fdec61ae8c383635889eb6a6fc7410192785ed
Instruction ID: a5f5dc096b2cee24c05f3ef1f28787f1d17ef795275ad9ed870bc115a3db030d
Opcode Fuzzy Hash: f8eaa589c78dcd0a7e03446927fdec61ae8c383635889eb6a6fc7410192785ed
Instruction Fuzzy Hash: 0D035D74A01228CFDB25EF74D954BA9BBB2FB88304F1041EAD90967395DB359E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C44544 Relevance: 4.1, Strings: 2, Instructions: 1618COMMON

Download Yara Rule

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: f7dd30cacc4619be281d20a50187325db6176bfd9ff67204f90ef83d9ffb0d46
Instruction ID: 57a871ff7dc0641d5ca3099520283c94f38b0961be8a8f1d580b9cfe8cd4a5e0
Opcode Fuzzy Hash: f7dd30cacc4619be281d20a50187325db6176bfd9ff67204f90ef83d9ffb0d46
Instruction Fuzzy Hash: 64035D74A01228CFDB25EF34D954BA9BBB2FB88304F1041EAD90967395DB359E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C44630 Relevance: 4.1, Strings: 2, Instructions: 1579COMMON

Download Yara Rule

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: 0b37e600a1522efbcafbf0582789907ff374de83ed1a814b8734b9b0a5d63bab
Instruction ID: 85d76d216218f08476b1fd4a8f32c5fe1051bb698106bbb2de6812b4b0b73e90
Opcode Fuzzy Hash: 0b37e600a1522efbcafbf0582789907ff374de83ed1a814b8734b9b0a5d63bab
Instruction Fuzzy Hash: 96035E74A01228CFDB25EF34D954BA9BBB2FB48304F1041EAD90967395DB399E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C4470F Relevance: 4.0, Strings: 2, Instructions: 1544COMMON

Download Yara Rule

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: 29f1b1bdc06358122980efec94d4bbeed436c3005de15d40b263151181bf480c
Instruction ID: 0f8f9b6ab528631e5372c0ad2a894e5f51355ed5a305d289d8e182a1c350ebe5
Opcode Fuzzy Hash: 29f1b1bdc06358122980efec94d4bbeed436c3005de15d40b263151181bf480c
Instruction Fuzzy Hash: C7F26E74A01228CFDB25EF74D954BA9BBB2FB88304F1041EAD90967395DB395E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C447D4 Relevance: 4.0, Strings: 2, Instructions: 1513COMMON

Download Yara Rule

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: aedb99ff3dc93c2d2dc893d6ed2551bcafd12d58df2c9ee58c3c6041ce4e675b
Instruction ID: 6712137d1b9035f1710c7935d833d352d784107916238a7417a55450bd3b9948
Opcode Fuzzy Hash: aedb99ff3dc93c2d2dc893d6ed2551bcafd12d58df2c9ee58c3c6041ce4e675b
Instruction Fuzzy Hash: BAF26D74A01228CFDB25EF34D954BA9BBB2FB88304F1041EAD90967395DB395E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C44936 Relevance: 4.0, Strings: 2, Instructions: 1456COMMON

Download Yara Rule

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: cb56467e5362bc09ce1380773f33270c9f99cdf6bafc11d17823aed8b2eff1a6
Instruction ID: c9de26d541d47f0e18b8331e7bdc5f215259729ab2103e481c8e8f6709299b46
Opcode Fuzzy Hash: cb56467e5362bc09ce1380773f33270c9f99cdf6bafc11d17823aed8b2eff1a6
Instruction Fuzzy Hash: 89F25D74A01228CFDB25EF34D954BA9BBB2FB89304F1041EAD90967395DB359E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C4499D Relevance: 3.9, Strings: 2, Instructions: 1447COMMON

Download Yara Rule

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: 5ca174bfd7c992efa80c24b6d7c1d494b2aedc398c8002e34745b70adfe1587b
Instruction ID: 2a384f3c5286035483729720838df3908467fc145ddd8dceee6fdbb83d952a1b
Opcode Fuzzy Hash: 5ca174bfd7c992efa80c24b6d7c1d494b2aedc398c8002e34745b70adfe1587b
Instruction Fuzzy Hash: 46F25D74A01228CFDB25EF34D954BA9BBB2FB89304F1041EAD90967395DB359E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C449F9 Relevance: 3.9, Strings: 2, Instructions: 1440COMMON

Download Yara Rule

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: 951a5e3c0a77cf3b77a26bfb38fc856f507553d02a009a3f5eeb1ad2709cfaf2
Instruction ID: febf9015e22ec936a4128e3a97d886f57b22b66ea312015fc9a512a0201ad341
Opcode Fuzzy Hash: 951a5e3c0a77cf3b77a26bfb38fc856f507553d02a009a3f5eeb1ad2709cfaf2
Instruction Fuzzy Hash: 88F26D74A01228CFDB25EF34D954BA9BBB2FB89304F1041EAD90967395DB359E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C44B5B Relevance: 3.9, Strings: 2, Instructions: 1383COMMON

Download Yara Rule

Strings

, xrefs: 04C44BC4
Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: $Yk^
API String ID: 0-737799909
Opcode ID: a0ca799ee2454f91d02b1f084c171567b1eec545ecb048ede7b5e9e24cfeead5
Instruction ID: 6d1683010c279de0e2863677f3ae29de6947b7aea097f27305695191675c372c
Opcode Fuzzy Hash: a0ca799ee2454f91d02b1f084c171567b1eec545ecb048ede7b5e9e24cfeead5
Instruction Fuzzy Hash: 22E26D74A01228CFDB25EF34D954BA9BBB2FB89304F1041EAD90967395DB359E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C44C8F Relevance: 2.6, Strings: 1, Instructions: 1362COMMON

Download Yara Rule

Strings

Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: Yk^
API String ID: 0-2647811921
Opcode ID: a54edea7b0d8b4d269a73b14b27bf162126ddf6ad6818c8731b7ce22b8adc9c7
Instruction ID: 3655d04d04e3ef9e35ab3908963b7066e6943e66022b750532e9a4e82a32135b
Opcode Fuzzy Hash: a54edea7b0d8b4d269a73b14b27bf162126ddf6ad6818c8731b7ce22b8adc9c7
Instruction Fuzzy Hash: F0E25D74A01228CFDB25EF34D954BA9BBB2FB89304F1041EAD90967395DB359E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C44F2F Relevance: 2.5, Strings: 1, Instructions: 1245COMMON

Download Yara Rule

Strings

Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: Yk^
API String ID: 0-2647811921
Opcode ID: b9197e5179a3b48250d84778aabc5434e5474054f47a2a571a7b524a8fc6c119
Instruction ID: 6a1cd3043a5b05d8229504749fb72f1e65bee83b97ff4a87ef0ac47ffc542d4b
Opcode Fuzzy Hash: b9197e5179a3b48250d84778aabc5434e5474054f47a2a571a7b524a8fc6c119
Instruction Fuzzy Hash: 54D25D74A01228CFDB25EF34D954BA9BBB2FB49304F1041EAD90967395DB399E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C44F9D Relevance: 2.5, Strings: 1, Instructions: 1236COMMON

Download Yara Rule

Strings

Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: Yk^
API String ID: 0-2647811921
Opcode ID: fd865e8f99e204bf94187cbac5ff6e842d54e4d2cb428682dd4f0e134c917f4c
Instruction ID: da4c98749fe993ec94af43391839789ab0629d6780917fb6b47cf592f0119633
Opcode Fuzzy Hash: fd865e8f99e204bf94187cbac5ff6e842d54e4d2cb428682dd4f0e134c917f4c
Instruction Fuzzy Hash: 88D25D74A01228CFDB25EF34D954BA9BBB2FB49304F1041EAD90967395DB399E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C45000 Relevance: 2.5, Strings: 1, Instructions: 1230COMMON

Download Yara Rule

Strings

Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: Yk^
API String ID: 0-2647811921
Opcode ID: dfabfcb19aed27d306977349c9d19a62a1ea139794d63f48bbb20dca70b352d1
Instruction ID: e78cc6d2308eb2d142fd518467002d9e8bf130ebfe1ded47f6cab25282e83819
Opcode Fuzzy Hash: dfabfcb19aed27d306977349c9d19a62a1ea139794d63f48bbb20dca70b352d1
Instruction Fuzzy Hash: 73D24D74A01228CFDB25EF34D954BA9BBB2FB49304F1041EAD90967395DB399E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C4505D Relevance: 2.5, Strings: 1, Instructions: 1225COMMON

Download Yara Rule

Strings

Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: Yk^
API String ID: 0-2647811921
Opcode ID: e6baa3761b65afa72f52854104074ff8f8dbb1cfba60e09d4217fd3a291be6ef
Instruction ID: d84261ee511978f1add250a48bb5ea49f006cae5299aa6b2bcec7628e7fe37ed
Opcode Fuzzy Hash: e6baa3761b65afa72f52854104074ff8f8dbb1cfba60e09d4217fd3a291be6ef
Instruction Fuzzy Hash: 74D25D74A01228CFDB25EF34D954BA9BBB2FB49304F1041EAD90967395DB399E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C450E3 Relevance: 2.5, Strings: 1, Instructions: 1210COMMON

Download Yara Rule

Strings

Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: Yk^
API String ID: 0-2647811921
Opcode ID: 0c72fd77d149920601153c8cc7b0008bbed8870ad3c9beff2f377a868efd4051
Instruction ID: bc919ce14a70ec8a14f869c138fb881bdb4ac80e0091783e0ceb3cef186e003e
Opcode Fuzzy Hash: 0c72fd77d149920601153c8cc7b0008bbed8870ad3c9beff2f377a868efd4051
Instruction Fuzzy Hash: 63D25D74A01228CFDB25EF34D954BA9BBB2FB89304F1041EAD90967395DB359E86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04C4536F Relevance: 2.3, Strings: 1, Instructions: 1071COMMON

Download Yara Rule

Strings

Yk^, xrefs: 04C45406, 04C4540B

Memory Dump Source

Source File: 00000000.00000002.1630227184.0000000004C40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4c40000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID: Yk^
API String ID: 0-2647811921
Opcode ID: 4f665a9081db83cecdf2daa1d039a9381e130b0c0837c30080af72b5ee547215
Instruction ID: 17918dcd48c085775aa3ace66a2718aee319627f840a0f7b93ef22ce73cb153b
Opcode Fuzzy Hash: 4f665a9081db83cecdf2daa1d039a9381e130b0c0837c30080af72b5ee547215
Instruction Fuzzy Hash: 17C24C74A01228CFDB25EF30D954BA9BBB6FB49304F1041EAD90967395DB35AE86CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00A52BDB Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1629663939.0000000000A52000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A52000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a52000_tiodtk2cfy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6695509683f7e78cd6cd66599bc543d55d31486852488a36bece0255d96e607
Instruction ID: d5c7de4526cb1e32721aa66a940f06742cfcac789edf5b02cd15dea74c62ff31
Opcode Fuzzy Hash: f6695509683f7e78cd6cd66599bc543d55d31486852488a36bece0255d96e607
Instruction Fuzzy Hash: 9431DE6504EBD15FD70B8B308CA2545BF71AE4351434E86CFC884CF6E7D32A990AC7A6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: server.exePID: 7592, Parent PID: 7508COMMON

Execution Graph

Execution Coverage:	24.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.2%
Total number of Nodes:	112
Total number of Limit Nodes:	7

Executed Functions

Function 04844298 Relevance: 3.2, Strings: 1, Instructions: 1950COMMON

Download Yara Rule

Strings

@, xrefs: 04844C24

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: e4adb59a96b9a8b8fd5843b716684a265b1f39650a2f2c00f2be9dbaa8098b47
Instruction ID: cadb763fa8f43cb53b67bc956f1b6928a2f3074a57ab232061628ea166ea7e77
Opcode Fuzzy Hash: e4adb59a96b9a8b8fd5843b716684a265b1f39650a2f2c00f2be9dbaa8098b47
Instruction Fuzzy Hash: 90236B74A012288FDB25EF35D854BADB7B2FB49308F1041E9D509AB398DB395E85DF80

Uniqueness

Uniqueness Score: -1.00%

Function 048444F1 Relevance: 2.9, Strings: 1, Instructions: 1624
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04844BC4

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0c46161e1de7f81ed5e5d8ea7bd67098128a2935b3e5920b7d5005ab17b53116
Instruction ID: b0f4a6afeab05eea48fbf4999e6629310b8a06eeb9df1f8690e2d9c623aec6bd
Opcode Fuzzy Hash: 0c46161e1de7f81ed5e5d8ea7bd67098128a2935b3e5920b7d5005ab17b53116
Instruction Fuzzy Hash: 63035A74A012288FDB25EF35D854BACB7B2FB49308F1041E9D509AB399DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04844544 Relevance: 2.9, Strings: 1, Instructions: 1618
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04844BC4

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: e4e6485ea78923ca57c49374cd6d20593ce76af1d9316686112e7f04db29334b
Instruction ID: 25c769061480ef4816796dda36cb5ae76610a5e034920e720a9522ad69106fef
Opcode Fuzzy Hash: e4e6485ea78923ca57c49374cd6d20593ce76af1d9316686112e7f04db29334b
Instruction Fuzzy Hash: 28035A74A012288FDB25EF35D854BACB7B2FB49308F1041E9D509AB399DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04844630 Relevance: 2.8, Strings: 1, Instructions: 1579
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04844BC4

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: b4b786cec745776b5ac97a160ac92ebbb969ddf087061485e1081a39daf98da8
Instruction ID: a273c2ff694fa589c8507e2cb439c72db5604dd62ada9373fc997bd5922bea58
Opcode Fuzzy Hash: b4b786cec745776b5ac97a160ac92ebbb969ddf087061485e1081a39daf98da8
Instruction Fuzzy Hash: AE035A74A012288FDB25EF35D854BACB7B2FB49308F1041E9D509AB399DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0484470F Relevance: 2.8, Strings: 1, Instructions: 1544
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04844BC4

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c5f25e824538d234d840329f20af0d43bbe71f20c31f22092f056365dfecc4b8
Instruction ID: dd14333161a9c21cd18e6c3d0255b3e6965a5c5ce5fca61de98297343538ee76
Opcode Fuzzy Hash: c5f25e824538d234d840329f20af0d43bbe71f20c31f22092f056365dfecc4b8
Instruction Fuzzy Hash: 9DF25B74A012288FDB25EF35D854BADB7B2FB49308F1041E9D509AB398DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 048447D4 Relevance: 2.8, Strings: 1, Instructions: 1513
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04844BC4

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 6f4b7ae993ccd4babdbc2e70cc867b4b45d82408b41a287531c44e95f51053c7
Instruction ID: 13ed2d9cf2ec15561d45db3cc15731a66328e8f06725c8fa2f4e1d0a9f525f5b
Opcode Fuzzy Hash: 6f4b7ae993ccd4babdbc2e70cc867b4b45d82408b41a287531c44e95f51053c7
Instruction Fuzzy Hash: 1DF25B74A012288FDB25EF35D854BADB7B2FB49308F1041E9D509AB398DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04844936 Relevance: 2.7, Strings: 1, Instructions: 1456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04844BC4

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c8be73d3524b2c18e95341ef29e34e4722e97b3edeab29ddfa2d5e6837ef8fee
Instruction ID: 782ac4532cebfb38f5318b599465c4ad7e5da96c90641de39da10dd039fad408
Opcode Fuzzy Hash: c8be73d3524b2c18e95341ef29e34e4722e97b3edeab29ddfa2d5e6837ef8fee
Instruction Fuzzy Hash: 62F26A74A01228CFDB25EF35D854BADB7B2BB49308F1041E9D509AB398DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 0484499D Relevance: 2.7, Strings: 1, Instructions: 1447
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04844BC4

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f4f5ecc2be7c16cfa158c2289071b22f593562876583163cb8beeadfdc359149
Instruction ID: 0a3f78e75b4ecee285daef6a788eb589eeeba61ed814568caf49cb2d993f64fc
Opcode Fuzzy Hash: f4f5ecc2be7c16cfa158c2289071b22f593562876583163cb8beeadfdc359149
Instruction Fuzzy Hash: 27F25A74A01228CFDB25EF35D854BADB7B2BB49308F1041E9D509AB398DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 048449F9 Relevance: 2.7, Strings: 1, Instructions: 1440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 04844BC4

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5eafca959e50c9703621d237607efc10930289e407cfeebc66715b427d8adfc4
Instruction ID: e46ed8a28d2e5bca2b2f0485cc14b3c089ddbeeb7b6b9ca68f30aee99352f8ae
Opcode Fuzzy Hash: 5eafca959e50c9703621d237607efc10930289e407cfeebc66715b427d8adfc4
Instruction Fuzzy Hash: 07F25A74A012288FDB25EF35D854BADB7B2BB49308F1041E9D509AB398DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04844C8F Relevance: 1.4, Instructions: 1362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f39f19d75d0738cbb43132854a38ba32da6e8ab227fc679d9ba30e1e7d89eca
Instruction ID: 458bb0fb76e15ccd1d44ecb7644df23d540aa780981a61d5f432ae1568c0580a
Opcode Fuzzy Hash: 3f39f19d75d0738cbb43132854a38ba32da6e8ab227fc679d9ba30e1e7d89eca
Instruction Fuzzy Hash: 13E25B74A012288FDB25EF35D850BADB7B2FB49304F1041E9D509AB399DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04844F2F Relevance: 1.2, Instructions: 1245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3861bb510c758ee09a308aa5fc9abcb9cc51b58e84cc394ae27329fa44c45aa7
Instruction ID: 8ef124dce5f87338b332435a4f84ac81efb2b4679992c2bc15289674b1c33289
Opcode Fuzzy Hash: 3861bb510c758ee09a308aa5fc9abcb9cc51b58e84cc394ae27329fa44c45aa7
Instruction Fuzzy Hash: 9CD26B74A01228CFDB25EF35D854BADB7B2BB49304F1041E9D909AB398DB355E85DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04844F9D Relevance: 1.2, Instructions: 1236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53d76e1a90fa839f1d369c52c7dbfea26074bef2a42f04b2aa6e941cb99a7c5
Instruction ID: bd19b712788c8c8e89fe916137adacde81097fd116a9a4151dbfe83413485073
Opcode Fuzzy Hash: c53d76e1a90fa839f1d369c52c7dbfea26074bef2a42f04b2aa6e941cb99a7c5
Instruction Fuzzy Hash: 15D25B74A01228CFDB25EF35D854BADB7B2BB49304F1041E9D909AB398DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04845000 Relevance: 1.2, Instructions: 1230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281c2e4e33732f5779a9fb547969307612b637a1d57a535cb6dbab9c719fa844
Instruction ID: 5e5d92774f94c4bed55432ef501e58ba7a3f3f12865e619e1f734736d24230c8
Opcode Fuzzy Hash: 281c2e4e33732f5779a9fb547969307612b637a1d57a535cb6dbab9c719fa844
Instruction Fuzzy Hash: 59D25A74A012288FDB25EF35D854BADB7B2BB49304F1041E9D909AB398DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 048450E3 Relevance: 1.2, Instructions: 1210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef98a5f1b7556bd38d05e0a33e47cbe381c2ec7c3a94bd1f5395c70ed6788556
Instruction ID: 1b8f927b7d72493b66d8dfb6d846cf94ea4e003a4c277d3e9f193a26731744bb
Opcode Fuzzy Hash: ef98a5f1b7556bd38d05e0a33e47cbe381c2ec7c3a94bd1f5395c70ed6788556
Instruction Fuzzy Hash: B0D25A74A012288FDB25EF35D850BADB7B2FB49304F1041E9D909AB399DB355E89DF80

Uniqueness

Uniqueness Score: -1.00%

Function 048475A8 Relevance: .5, Instructions: 497COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e4e7bdc123157172fdd339e0794bbea9c53671cc97d233a83a479dd6d10901
Instruction ID: 813301ef0fa8c67ba43ca873f0170c9624fb0be14e386f6f8ac1cd8876d9cb15
Opcode Fuzzy Hash: 53e4e7bdc123157172fdd339e0794bbea9c53671cc97d233a83a479dd6d10901
Instruction Fuzzy Hash: 2D0226325052669BDB2A9F329850479B3A2BFC03953458B3AD461DB3D8EF2EFC41D790

Uniqueness

Uniqueness Score: -1.00%

Function 0484758E Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e24c9a188ec5521b930e51a718103bf7a471839b8faefce9bf8fa3ae7da016f
Instruction ID: 2501d41cdd39f649216332e1ee334a9ae0e99c9bbc4fb240e21d1c4fff7b82d8
Opcode Fuzzy Hash: 3e24c9a188ec5521b930e51a718103bf7a471839b8faefce9bf8fa3ae7da016f
Instruction Fuzzy Hash: 8FC13B316053A68BD722EB33A85043577A37FC01963458A77E490CF2D9EF28ED85E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 048480A0 Relevance: 1.2, Instructions: 1241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b469ca3a033b4a52359c2e38ee08386a941ed286c506a9e9e4a76f988ee2fa83
Instruction ID: 52deec38523dcbe5ac17b590a07f1f4801de96fe932ee9ba9695b7703dbc41f8
Opcode Fuzzy Hash: b469ca3a033b4a52359c2e38ee08386a941ed286c506a9e9e4a76f988ee2fa83
Instruction Fuzzy Hash: 78C29074B04258CFDB21AB3AD9107AD77B2AB89304F0085679805DBB9CDF749D98EF60

Uniqueness

Uniqueness Score: -1.00%

Function 0484811C Relevance: 1.1, Instructions: 1079COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47162514b693aa0bec52d96a4a3c615cb66b5941cbdaea1c24aff42daf5fc6bb
Instruction ID: 08e317aaf6e7390569e6beb385c8a58435fad62bb10896719b7eff60dda62801
Opcode Fuzzy Hash: 47162514b693aa0bec52d96a4a3c615cb66b5941cbdaea1c24aff42daf5fc6bb
Instruction Fuzzy Hash: E692D234B042688BDF25AB3ADC107BD77A6AB88308F0049679445D7B9CDF749D98EF60

Uniqueness

Uniqueness Score: -1.00%

Function 04848185 Relevance: 1.1, Instructions: 1075COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fa9a6dbeda909220a7f40ed1f4437d41efd8a38b47084ffec37d0ff52dcf55
Instruction ID: 5cee2c216a6107bda8142e855971e162d0aab42954f687395d21ad86921a8c96
Opcode Fuzzy Hash: d4fa9a6dbeda909220a7f40ed1f4437d41efd8a38b47084ffec37d0ff52dcf55
Instruction Fuzzy Hash: 0F92C134B042688BDF21AB3ADC107BD77A6AB88308F0048679405D7B9CDF749D98EF60

Uniqueness

Uniqueness Score: -1.00%

Function 0484562A Relevance: 1.0, Instructions: 963COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9bcc6733c62277d18bb806a796e8ac11a50972eb4fa735727359242e668c930
Instruction ID: 2f8b384ecd9be0686e950a7e1c120ca19d40db3e468ac67282c1a98f9eb8e62e
Opcode Fuzzy Hash: a9bcc6733c62277d18bb806a796e8ac11a50972eb4fa735727359242e668c930
Instruction Fuzzy Hash: E8B21974A01228CFDB25EF34D854BA9B7B2FB49304F1051E9D909AB398DB356E85DF80

Uniqueness

Uniqueness Score: -1.00%

Function 048457A1 Relevance: .9, Instructions: 906COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1963cfa7ac4786153024aed0e57475fcf0c09c0aa154c96212544757b45c00f
Instruction ID: a1e28eccceee2408f0276a5dee3146101fe55c58e3deacf72ae39d73ddd3f846
Opcode Fuzzy Hash: f1963cfa7ac4786153024aed0e57475fcf0c09c0aa154c96212544757b45c00f
Instruction Fuzzy Hash: 28A22874A01228CFDB25EF34D854BA9B7B2FB49304F1051E9D909AB398DB356E85DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04845918 Relevance: .8, Instructions: 849COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1b1e54fd222f26de2d7b3656b931a97491f6a52a20251c519624a04348553f
Instruction ID: aa6a36db307429fd8f1be031a3011a516ad391c829a52578900086cbabef0767
Opcode Fuzzy Hash: 2a1b1e54fd222f26de2d7b3656b931a97491f6a52a20251c519624a04348553f
Instruction Fuzzy Hash: 48922974A01228CFDB25EF34D854BA9B7B2FB49304F1051E9D909AB398DB356E85DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04845A8F Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 174cfd1a7c09164d627f9c214d41e1af4239e378368f592899044a19339efe1b
Instruction ID: d39c68d993555c36ad702f1f0ccb1a8b0ce128dc8e07ae30aac3e3175583bf78
Opcode Fuzzy Hash: 174cfd1a7c09164d627f9c214d41e1af4239e378368f592899044a19339efe1b
Instruction Fuzzy Hash: C5922B74A01228CFDB25EF34D854BA8B7B2FB49304F1051E9D509AB398DB35AE85DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04845C06 Relevance: .7, Instructions: 735COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a2eba7c53829ea1e63c1b03f807545dbe89f2f2dccc9e7671353b502696608
Instruction ID: b89cf639f5003a028b4a4b0e3a3f593ac57e9923811bc0176252e307d489b885
Opcode Fuzzy Hash: 37a2eba7c53829ea1e63c1b03f807545dbe89f2f2dccc9e7671353b502696608
Instruction Fuzzy Hash: D3823D74A01228CFDB25EF34D854BA8B7B6FB49304F1051E9D509AB398DB35AE85DF80

Uniqueness

Uniqueness Score: -1.00%

Function 04845EF4 Relevance: .6, Instructions: 621COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2774ea1110b360ac592c9b2889fa479547dae5a18c0d36473e03c7661f95d9f7
Instruction ID: 9acf3ca388fafce7059a723f4c622b73f265db28cf4be00dd4020e8c4fe69879
Opcode Fuzzy Hash: 2774ea1110b360ac592c9b2889fa479547dae5a18c0d36473e03c7661f95d9f7
Instruction Fuzzy Hash: 52623C74A01228CFDB25EF34D854BA8B7B6FB49304F1051E9D909AB398DB35AE85DF40

Uniqueness

Uniqueness Score: -1.00%

Function 048461E2 Relevance: .5, Instructions: 507COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d1ebf8aec9bc6c4ff082e6d98c79474aaf528adced485b7b475bce1d23a8f3
Instruction ID: 75301d545b776fe15cb45364407f9c6797a8acb8df514335cdb790a957d0429c
Opcode Fuzzy Hash: f4d1ebf8aec9bc6c4ff082e6d98c79474aaf528adced485b7b475bce1d23a8f3
Instruction Fuzzy Hash: 59422E74A01228CFDB25EF34D854BA8B7B5FB49304F1085E9D909AB398DB35AE85DF40

Uniqueness

Uniqueness Score: -1.00%

Function 04843801 Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e44f121d5d724124270a6a48d798f7569770073fd5ab9eabeda5cb1632c5c576
Instruction ID: ec10e6c8be19d2c70236fc18c1fe87161841ba60119c4f94dffecc766dcee48c
Opcode Fuzzy Hash: e44f121d5d724124270a6a48d798f7569770073fd5ab9eabeda5cb1632c5c576
Instruction Fuzzy Hash: 1B323B30A01218CFDB25EF74D855BEDB7B2BB89308F1045A9D409AB399DB395E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 04846483 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98ebac44fd191a5998c79d3474500afb48ad371d0d76a40eb3addb552a81e39e
Instruction ID: 5000519de4f3e64dc2cd5595ebb8dd2315db96a62e1be3c716d27564213074c1
Opcode Fuzzy Hash: 98ebac44fd191a5998c79d3474500afb48ad371d0d76a40eb3addb552a81e39e
Instruction Fuzzy Hash: 9F223D74A01228CFDB25DF34D854BA8B7B5FB49304F1085EAD909AB398DB35AE84DF40

Uniqueness

Uniqueness Score: -1.00%

Function 048467A9 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9295b37eafb58504c38beda7bf80cbb701ccc38b5aa5069f9c97c8d6069ed21
Instruction ID: a26c0eaa41e5bfb51515c17f79ea21b02ff342a4116a98e42da12952978b389e
Opcode Fuzzy Hash: e9295b37eafb58504c38beda7bf80cbb701ccc38b5aa5069f9c97c8d6069ed21
Instruction Fuzzy Hash: 27023C74A01218CFDB25EF34D854BACB7B6BB49304F5045EAD909AB398DB359E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 048496C8 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a519db181757d921f543b264eadbdc6dd1a64fcc935f0eff3a395d4285ba3588
Instruction ID: 231466c643482767a9241a628bbcf9bdcad7f42a5ef83210f7ba77b5ae9677da
Opcode Fuzzy Hash: a519db181757d921f543b264eadbdc6dd1a64fcc935f0eff3a395d4285ba3588
Instruction Fuzzy Hash: 30D13170F00208DFCB19EFB5E45156E77B6AF88248B608529E4119B3ACDF39AC49DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0484690A Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aba7cfee41cfc1f6e8bdcc45a36d2addb9516ac766989a8c6f1fd8bb64e012b
Instruction ID: 6290e528231c2b9b523b978c68af4846419ee770020e933ba02239e46eefec7e
Opcode Fuzzy Hash: 5aba7cfee41cfc1f6e8bdcc45a36d2addb9516ac766989a8c6f1fd8bb64e012b
Instruction Fuzzy Hash: 98D13E74A01228CFDB25EF34D854BADB7B1BB89308F5045EAD509AB394DB399E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 048496B7 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f84419b1642fe7a17749fffcb73c0407319dacc9147400b1653e0eab46d5268
Instruction ID: a8604c50dec5c2f4ada6b334072d4623157febc9d9846a2ff9bdaed23c2f2893
Opcode Fuzzy Hash: 6f84419b1642fe7a17749fffcb73c0407319dacc9147400b1653e0eab46d5268
Instruction Fuzzy Hash: 2EA15F70B00204DFCB19EF75E851A5E77B6AF88348B608529E4119B3ACDF39AC59DF90

Uniqueness

Uniqueness Score: -1.00%

Function 048497CD Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24cf70a45332404bc960f592947284f90b7f0f6154163e8622e63c72f99064d9
Instruction ID: cb16edb40780060f400cbfeefd654a3e1e94e775b193ac91c4c96a204c368444
Opcode Fuzzy Hash: 24cf70a45332404bc960f592947284f90b7f0f6154163e8622e63c72f99064d9
Instruction Fuzzy Hash: 34913F34B00208DFCB19EFB5E451A6D77B2AF88348B608529E4119B7ACDF39AC55DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0484982B Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4dbfba677cbd6bad21f23e5c1b207fa313984aa269b9fae5195600eea4aa0e7
Instruction ID: 38bccde7df095975882fa77f8acb42846c69e4e9f94612d177d073b30b78862e
Opcode Fuzzy Hash: e4dbfba677cbd6bad21f23e5c1b207fa313984aa269b9fae5195600eea4aa0e7
Instruction Fuzzy Hash: 99914E34B00204DFCB19EFB5E451A6D73B2AF88348B608529E4119B7ACDF39AC59DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04846B55 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984f3b626185dbcdd729fdab1dd90d6a14260764946d874cb93b96d948a75419
Instruction ID: 87c3976aa08fb1c99205195bf8fd8046673bce167b38e3c7df9bfa694fb430f0
Opcode Fuzzy Hash: 984f3b626185dbcdd729fdab1dd90d6a14260764946d874cb93b96d948a75419
Instruction Fuzzy Hash: D8913E70A012288FDB25EF35D855BAD73B2AF85308F5046ED9509AB394DF396E85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 04843DCC Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df62237eacfc5c86f7c60a0f22489d3c397ee0350dbb65a5484acec1a48d998f
Instruction ID: 10fb707e9ddc2c4f6b7038b4bdda0c8dd7e5434cf3b63d6bed3e366b2e7b8594
Opcode Fuzzy Hash: df62237eacfc5c86f7c60a0f22489d3c397ee0350dbb65a5484acec1a48d998f
Instruction Fuzzy Hash: 0AA1F334A01228CFCB25EF75D950BACB7B2BB49308F1045A9D809AB359DB359E85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 048498FD Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b114d3505fff0ab0e79439393bf2bd88b5bde16885c3e28a45a6b5acdaa2cc0a
Instruction ID: 07625c5d63b3bde001ba5a3e6e2f72fa992c05dea5e5360b03d70ded8d482bcd
Opcode Fuzzy Hash: b114d3505fff0ab0e79439393bf2bd88b5bde16885c3e28a45a6b5acdaa2cc0a
Instruction Fuzzy Hash: D5714F34B01204DFCB19EF75E45166D73B6AF88348B608529E8119B7ACDF39AC59DF80

Uniqueness

Uniqueness Score: -1.00%

Function 048439BF Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78c56c5e5f528f466e25b3ae8e01508b7dbb64c4593cb38bc4e5cd149c735de9
Instruction ID: b09ccc06fcb23dbec2cebdf2dac978e15edeb500e441ae73e17e0975c3ecf725
Opcode Fuzzy Hash: 78c56c5e5f528f466e25b3ae8e01508b7dbb64c4593cb38bc4e5cd149c735de9
Instruction Fuzzy Hash: 95814C30A01218CFDB24EFB4C855BADB7F2AF85308F5045A9D50AAB398DB795D88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 048499ED Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf56da188a5b65441d18b702c95f7f7e737ea18ec344765847116b2ec99bc88b
Instruction ID: 11e53c050d02d91b63a8651987b544309aa555c16c09ac9db756815925c1698a
Opcode Fuzzy Hash: bf56da188a5b65441d18b702c95f7f7e737ea18ec344765847116b2ec99bc88b
Instruction Fuzzy Hash: 50518430B00214DFCB19EF75E85166E73A6EF84358F208529E8119B7ACDF38AC55DB90

Uniqueness

Uniqueness Score: -1.00%

Function 04847310 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0bbb86d200b6ef6993149ec1cbbfb62185eabfd9b9e2e5a49f8c14d4a6f8d49
Instruction ID: 004c615da964836bb1fe6a6b7bfa929a6d30968725ecfbf347e10b790248902b
Opcode Fuzzy Hash: a0bbb86d200b6ef6993149ec1cbbfb62185eabfd9b9e2e5a49f8c14d4a6f8d49
Instruction Fuzzy Hash: 0551E2307002448FCB06EB78D454ABD7BF2AF89208B2485ADD405DF39ADF399C4ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 04848046 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2701c98655b9f590c3c1744d2420decfaa9de5416d92f4a10d550fac0842ee5
Instruction ID: 290f15588ec1cf6b9c5476728d268f2f51a99814b02dec0efedef02dcd62f24c
Opcode Fuzzy Hash: a2701c98655b9f590c3c1744d2420decfaa9de5416d92f4a10d550fac0842ee5
Instruction Fuzzy Hash: 7F41E7317043098FD724EF36D8017B933E2AB85355F584A69D411DB2D9EF38EA49DB60

Uniqueness

Uniqueness Score: -1.00%

Function 04843B18 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc2560622dd12dc061e682349bbab48d723059ee61b589259f67d66aa03a0f62
Instruction ID: a59bc04d89de0462721105a587973692be18c0a00d47d1f14ad393248391d647
Opcode Fuzzy Hash: bc2560622dd12dc061e682349bbab48d723059ee61b589259f67d66aa03a0f62
Instruction Fuzzy Hash: 7E415A30A00218CFDB24EFB9C954BECB7F2BF85309F5045AAD409AB295DB795A48CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04849FC8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0a4498a6b47b45f26dff00525b27f9ee6348723aa918942eef03ec77e38faeb
Instruction ID: 24d82343cec12f4223cca77b4b5a025155b7861bd2299a95e6a54be0cfb0276e
Opcode Fuzzy Hash: a0a4498a6b47b45f26dff00525b27f9ee6348723aa918942eef03ec77e38faeb
Instruction Fuzzy Hash: 2E31D574B402099FDB18DB79D854BAEBBF2AFC8244F144539E405EB3A1DF74A8088B91

Uniqueness

Uniqueness Score: -1.00%

Function 048400B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d92786fd855cd369aa1c0fec7edb5dca0627de6d37b70b3bc4b89eab469b48
Instruction ID: 8a6a62efe84049e3c067fbc8fefc60a110f73db9e780f34291b629f80d12eae4
Opcode Fuzzy Hash: 75d92786fd855cd369aa1c0fec7edb5dca0627de6d37b70b3bc4b89eab469b48
Instruction Fuzzy Hash: E43124316083449FCB15E7769812B6E3BA7ABC2248B1488BED001CF2D6DF795C09C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 048436DF Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7eb6b1dd61196a476ac59b6fe3db1799c6cd9ca9170d89469b68f5d4a458903
Instruction ID: be21a5ec7fc91720e91291bf7fd46f072a8c2f0d2feeb0c0df3998a25fd8bb14
Opcode Fuzzy Hash: d7eb6b1dd61196a476ac59b6fe3db1799c6cd9ca9170d89469b68f5d4a458903
Instruction Fuzzy Hash: 0E319F7470124A9FEB20DB69CC80BAA77E5FFCA244F140979D941EB784DB70E9098B90

Uniqueness

Uniqueness Score: -1.00%

Function 048436F0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5185dfe74b84d98a712e434f023b757c9c5e50d6b9b1abb2e9362a2ccc812c3c
Instruction ID: a97bbfd795ccd344eb2d268c35878c01139c3922965bc95a52d7505ccbbc1d65
Opcode Fuzzy Hash: 5185dfe74b84d98a712e434f023b757c9c5e50d6b9b1abb2e9362a2ccc812c3c
Instruction Fuzzy Hash: CC212F757002499FEB20DB6AC881BAA73E5FFC9244F140978E941EB794E770FD158790

Uniqueness

Uniqueness Score: -1.00%

Function 00AF07E4 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4063584630.0000000000AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0859269b9f07b27167d985ede3be9853a8e2ad01e83e8a32e05a33903d635c
Instruction ID: 62aae6143758902a9505e45f5b600a34ae53a954e9cd05daf23ece549b216f08
Opcode Fuzzy Hash: 2b0859269b9f07b27167d985ede3be9853a8e2ad01e83e8a32e05a33903d635c
Instruction Fuzzy Hash: F211E434204684DFC711CB64D980F26B7A5AB88708F24C9ACF5491BB43C77BD843CAD1

Uniqueness

Uniqueness Score: -1.00%

Function 04840118 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5407b648b5eb10138beb9b4e226a08d933aa45949e50aca69a91fa702951cbb1
Instruction ID: 1d19cad46f159f627dc7ffbe87f7c68c5b0d623756dc6d93d4a9cbadceb7afb7
Opcode Fuzzy Hash: 5407b648b5eb10138beb9b4e226a08d933aa45949e50aca69a91fa702951cbb1
Instruction Fuzzy Hash: 5A1102316097408FC725A37AA451A6D2BD7ABC328935488BDD0028F796CF799C0D97D2

Uniqueness

Uniqueness Score: -1.00%

Function 048474E0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0b9e5891bd2e9713463a79c1dd7fc436d4e9866fc343b60d569406e69ff036
Instruction ID: 593424902f1079c290a0c1bcc580273e91006a4c67584dbf15f6b798a32bd126
Opcode Fuzzy Hash: 1c0b9e5891bd2e9713463a79c1dd7fc436d4e9866fc343b60d569406e69ff036
Instruction Fuzzy Hash: DB0192342093904FC7266378A8214693BA2DBC320674545EFD8829F69BDB295C0AC392

Uniqueness

Uniqueness Score: -1.00%

Function 04849CE8 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d26cf024155d222df023cfafcb5efb635eae35a6b6469e354862617a6f7963
Instruction ID: d702e984731fa39095a8bafa25f69f1e37411da9e71f95e331c37dc7b86d8d7e
Opcode Fuzzy Hash: 21d26cf024155d222df023cfafcb5efb635eae35a6b6469e354862617a6f7963
Instruction Fuzzy Hash: 7211E331F002588FCB55DBB898154AEBBF6AB9A24471041BEC805EB356EB359E05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04840007 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e497b60514a8223858d09f70c371a43fcf65d626c9dfc76d10d81f6500d743
Instruction ID: 24412ba4dcadfab7a8c9fb4da9baa05987ea29c878a06701f40f94c8521198a0
Opcode Fuzzy Hash: 71e497b60514a8223858d09f70c371a43fcf65d626c9dfc76d10d81f6500d743
Instruction Fuzzy Hash: 8611AB6040F3C55FC3139734AC686947FB0AE43209B4E84DBC8D0CF2A7C6685A0EE7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00AF07C6 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4063584630.0000000000AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1b3acab3ec386dbdea6b4390e6908fe3af89a4d7a257152f6b217cae398f9b
Instruction ID: a6246d0a4982dd512c97633c92c1f96c912238614a7b8547e0c7dcb32677d4ff
Opcode Fuzzy Hash: 5c1b3acab3ec386dbdea6b4390e6908fe3af89a4d7a257152f6b217cae398f9b
Instruction Fuzzy Hash: 011130315093C48FC712CB50C950B55BFB1AF4A708F19C5EEE5854B6A3C33A9C06DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00AF05E1 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4063584630.0000000000AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab612d99231f558730d5e409526e9a7de92ac850f3b72dec33328996fe4f02e
Instruction ID: c0cc3eac3e713263feab5d85feaa284ce8afd91b7ebe533d9d1aa467db557233
Opcode Fuzzy Hash: 9ab612d99231f558730d5e409526e9a7de92ac850f3b72dec33328996fe4f02e
Instruction Fuzzy Hash: 1FF0A9B65093806FD7118B059C41862FFF8DF86620709C4AFED498B712D225A909C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 048401E1 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffc60503c7bd2669c5d883ff037a041d00027fee30e20c3c9fdc7e3c42a5fd90
Instruction ID: 9ae220ed7cc2a275c462d37eb89475ef16e69224227e3189cfbe6d9e7ebdee0f
Opcode Fuzzy Hash: ffc60503c7bd2669c5d883ff037a041d00027fee30e20c3c9fdc7e3c42a5fd90
Instruction Fuzzy Hash: 06011E30516341CFCB50EB79D55899C7BE1EF89309F40882CE8558B65AEB359948EF41

Uniqueness

Uniqueness Score: -1.00%

Function 048400A8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 578c6516802aabfb1f4c50047e5426ea647d69d168474aa1636dbf89ee6efaea
Instruction ID: 7390d01e170205a80801c132559adaa4dc9c880ccd405a7232b9eda4180af78e
Opcode Fuzzy Hash: 578c6516802aabfb1f4c50047e5426ea647d69d168474aa1636dbf89ee6efaea
Instruction Fuzzy Hash: 75F09672A013049FEB14DB70C852BAF7BB2EFC1724F1085BEA541DB1D1EA355841C740

Uniqueness

Uniqueness Score: -1.00%

Function 00AF08A0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4063584630.0000000000AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74b9f174851936b42c91253ba0377f3a0e724fe011995a5d7daf0febe73ee2ff
Instruction ID: 376da87be0d1826dbd3037f3a00ddafcda0aac8ad955dbf49aad11815da919ef
Opcode Fuzzy Hash: 74b9f174851936b42c91253ba0377f3a0e724fe011995a5d7daf0febe73ee2ff
Instruction Fuzzy Hash: 9AF0FB35144644DFC605CB50D540F25FBA2EB89718F24CAA9E9491B652C737E812DA81

Uniqueness

Uniqueness Score: -1.00%

Function 00AF0606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4063584630.0000000000AF0000.00000040.00000020.00020000.00000000.sdmp, Offset: 00AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_af0000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0329d58375c2bf3a5aef05cb1214bb31c1c83fac34b7be2bb8bfb6601afe7b39
Instruction ID: 91107a811b822c226546aca3ba0eb894cfcbb3a875b5db48cda81458f2ec8bc3
Opcode Fuzzy Hash: 0329d58375c2bf3a5aef05cb1214bb31c1c83fac34b7be2bb8bfb6601afe7b39
Instruction Fuzzy Hash: 61E092B6A006004BD650CF0EEC41452FBD8EB88630B08C47FDD0D8BB11D235B908CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 04844200 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94ffe1c2afe8dd694e909c810ba7ee64c4a4f6f654be1a5b46a1fee895191af
Instruction ID: 994210d13d75059890f5a3e1c2704112730f489d44fb28852afb52a0b653d07b
Opcode Fuzzy Hash: a94ffe1c2afe8dd694e909c810ba7ee64c4a4f6f654be1a5b46a1fee895191af
Instruction Fuzzy Hash: C7E04F3091F2889FCB42CF749D215EC7FB0DB4220571442EED84ACB6A2DA251A09DB42

Uniqueness

Uniqueness Score: -1.00%

Function 04849F88 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221c9f8fb466d3df10f839574dbdb051bdae6cca8b886bea367e45c7c8f4f8ff
Instruction ID: 5234e796fb16c7e40c64115a2e3b03ce0ea4732099857208eec60f3b19966a73
Opcode Fuzzy Hash: 221c9f8fb466d3df10f839574dbdb051bdae6cca8b886bea367e45c7c8f4f8ff
Instruction Fuzzy Hash: B4E08C2090E2C85FCB13CBB09C658EE7F70898210131401DFC842CB2A3D9250A0D9B43

Uniqueness

Uniqueness Score: -1.00%

Function 048436A8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6e9e41166eb1b3b178d099606ea80f19f11883e50cfcf8fd420b31543d818a
Instruction ID: 6508bd1f2e79194b230f27df1af5e4c6b5f283d2969292e0a4cdc18e70ea9e7a
Opcode Fuzzy Hash: 0a6e9e41166eb1b3b178d099606ea80f19f11883e50cfcf8fd420b31543d818a
Instruction Fuzzy Hash: 7DE0E63015B3948FC7175B34A42585C3B759A4720535404FFD446CB696D676948ADB41

Uniqueness

Uniqueness Score: -1.00%

Function 009423F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4063315361.0000000000942000.00000040.00000800.00020000.00000000.sdmp, Offset: 00942000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_942000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f819e1f91946dc808ebecbe818d4282f09b47d36ac3e9a6a21929928215839a
Instruction ID: 50a27cfcd2c7a516cf59bc2d1f581acf9d248397be926f7fadc88a6e9645fde0
Opcode Fuzzy Hash: 7f819e1f91946dc808ebecbe818d4282f09b47d36ac3e9a6a21929928215839a
Instruction Fuzzy Hash: 55D05E79209AD14FD3269B1CC6A8FA537D8BB51714F8A44F9A800CBBB3CB68D981D600

Uniqueness

Uniqueness Score: -1.00%

Function 009423BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4063315361.0000000000942000.00000040.00000800.00020000.00000000.sdmp, Offset: 00942000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_942000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c2300716345f04d26a57c375475c5d5b7fa6b11abfa59eb762c228bc090959
Instruction ID: f1f9895e331b1ba00c097f3adbb71b7b39d612e8467e8500ddc88ad7cec311b8
Opcode Fuzzy Hash: d3c2300716345f04d26a57c375475c5d5b7fa6b11abfa59eb762c228bc090959
Instruction Fuzzy Hash: 06D05E342002814BC725DF0CC2D4F5977E8BB40B14F0644E8BC108B762C7B8DCC0DA00

Uniqueness

Uniqueness Score: -1.00%

Function 04844210 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.4066771549.0000000004840000.00000040.00000800.00020000.00000000.sdmp, Offset: 04840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4840000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2907166c9a65dea99e0590db98f6f10668404968c2dbfd8643b8ea598c5cab4
Instruction ID: 0362a7b70d0b623c356b9e2e01c3598a1431e4f8b00f1de5ee2c17b78743d90f
Opcode Fuzzy Hash: a2907166c9a65dea99e0590db98f6f10668404968c2dbfd8643b8ea598c5cab4
Instruction Fuzzy Hash: 5AD0A931A16208EF8B40DFA8DC008ADB7F8EB0520AB0001AAA80DC3310EE321E00EB80

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report tiodtk2cfy.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Umbrella.flv.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Microsoft Corporation.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\tiodtk2cfy.exe.log

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1d56127836419435d08d7cc0808a629Windows Update.exe

C:\Users\user\AppData\Roaming\app

C:\Users\user\AppData\Roaming\server.exe

C:\autorun.inf

C:\winhost.exe

\Device\ConDrv

Static File Info

General

Windows Analysis Report
tiodtk2cfy.exe

Function 04C44298 Relevance: 4.4, Strings: 2, Instructions: 1950
COMMON

Function 04C44269 Relevance: 4.3, Strings: 2, Instructions: 1757
COMMON

Function 04C400B8 Relevance: 2.6, Strings: 2, Instructions: 96
COMMON

Function 04C40118 Relevance: 2.6, Strings: 2, Instructions: 59
COMMON

Function 00A5AA75 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 00A5B036 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Function 00A5A6CE Relevance: 1.6, APIs: 1, Instructions: 85
comclipboardCOMMON

Function 00A5AE77 Relevance: 1.6, APIs: 1, Instructions: 78
fileCOMMON

Function 00A5AAA6 Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Function 00A5AC37 Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Function 00A5A9BF Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Function 00A5B06A Relevance: 1.6, APIs: 1, Instructions: 72
synchronizationCOMMON

Function 00A5AB7C Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 00A5A61E Relevance: 1.6, APIs: 1, Instructions: 65
comCOMMON

Function 00A5A573 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON