Edit tour

Windows Analysis Report
ae6T8jJueq.exe

Overview

General Information

Sample name:	ae6T8jJueq.exe renamed because original name is a hash value
Original sample name:	3F3186F4BE8DF39294C1A53F1CD22214.exe
Analysis ID:	1390011
MD5:	3f3186f4be8df39294c1a53f1cd22214
SHA1:	a312a3bb6eb240ade59f390e551a68f6c93ff4da
SHA256:	73dcc6e8f005fafcfedfb31d8465ba9f51cebe4b359f5b931765d3af5c10fa05
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to log keystrokes (.Net Source)

Disables zone checking for all users

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

ae6T8jJueq.exe (PID: 6336 cmdline: C:\Users\user\Desktop\ae6T8jJueq.exe MD5: 3F3186F4BE8DF39294C1A53F1CD22214)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "0.tcp.in.ngrok.io:15032", "Campaign ID": "powerchang", "Install Name": "ae6T8jJueq.exe", "Install Dir": "Desktop"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ae6T8jJueq.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
ae6T8jJueq.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
ae6T8jJueq.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0xb7ff:$a1: get_Registry 0xeaf4:$a2: SEE_MASK_NOZONECHECKS 0xe8be:$a3: Download ERROR 0xec48:$a4: cmd.exe /c ping 0 -n 2 & del "
ae6T8jJueq.exe	Unknown_Malware_Sample_Jul17_2	Detects unknown malware sample with pastebin RAW URL	Florian Roth	0xf376:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xdb86:$s2: https://pastebin.com/raw/ 0xf8ae:$s3: My.Computer 0xf350:$s4: MyTemplate
ae6T8jJueq.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0xeaf4:$a2: SEE_MASK_NOZONECHECKS 0xecd0:$b1: [TAP] 0xec48:$c3: cmd.exe /c ping
ae6T8jJueq.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0xeaf4:$reg: SEE_MASK_NOZONECHECKS 0xe89a:$msg: Execute ERROR 0xe8fa:$msg: Execute ERROR 0xec48:$ping: cmd.exe /c ping 0 -n 2 & del
ae6T8jJueq.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0xe394:$s1: \Classes\mscfile\shell\open\command 0xe3dc:$s2: eventvwr.exe
ae6T8jJueq.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0xec48:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0xe89a:$s4: Execute ERROR 0xe8fa:$s4: Execute ERROR 0xe8be:$s5: Download ERROR 0xec86:$s6: [kl]
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0xb5ff:$a1: get_Registry 0xe8f4:$a2: SEE_MASK_NOZONECHECKS 0xe6be:$a3: Download ERROR 0xea48:$a4: cmd.exe /c ping 0 -n 2 & del "
00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0xe8f4:$a2: SEE_MASK_NOZONECHECKS 0xead0:$b1: [TAP] 0xea48:$c3: cmd.exe /c ping
00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0xe8f4:$reg: SEE_MASK_NOZONECHECKS 0xe69a:$msg: Execute ERROR 0xe6fa:$msg: Execute ERROR 0xea48:$ping: cmd.exe /c ping 0 -n 2 & del
Process Memory Space: ae6T8jJueq.exe PID: 6336	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.ae6T8jJueq.exe.110000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.ae6T8jJueq.exe.110000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.0.ae6T8jJueq.exe.110000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0xb7ff:$a1: get_Registry 0xeaf4:$a2: SEE_MASK_NOZONECHECKS 0xe8be:$a3: Download ERROR 0xec48:$a4: cmd.exe /c ping 0 -n 2 & del "
0.0.ae6T8jJueq.exe.110000.0.unpack	Unknown_Malware_Sample_Jul17_2	Detects unknown malware sample with pastebin RAW URL	Florian Roth	0xf376:$s1: 4System.Web.Services.Protocols.SoapHttpClientProtocol 0xdb86:$s2: https://pastebin.com/raw/ 0xf8ae:$s3: My.Computer 0xf350:$s4: MyTemplate
0.0.ae6T8jJueq.exe.110000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0xeaf4:$a2: SEE_MASK_NOZONECHECKS 0xecd0:$b1: [TAP] 0xec48:$c3: cmd.exe /c ping
0.0.ae6T8jJueq.exe.110000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0xeaf4:$reg: SEE_MASK_NOZONECHECKS 0xe89a:$msg: Execute ERROR 0xe8fa:$msg: Execute ERROR 0xec48:$ping: cmd.exe /c ping 0 -n 2 & del
0.0.ae6T8jJueq.exe.110000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer	detects Windows exceutables potentially bypassing UAC using eventvwr.exe	ditekSHen	0xe394:$s1: \Classes\mscfile\shell\open\command 0xe3dc:$s2: eventvwr.exe
0.0.ae6T8jJueq.exe.110000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0xec48:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 63 00 20 00 70 00 69 00 6E 00 67 0xe89a:$s4: Execute ERROR 0xe8fa:$s4: Execute ERROR 0xe8be:$s5: Download ERROR 0xec86:$s6: [kl]
Click to see the 3 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749760150322033132 02/09/24-22:13:05.137013
SID:	2033132
Source Port:	49760
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749763150322033132 02/09/24-22:13:10.067278
SID:	2033132
Source Port:	49763
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449729150322033132 02/09/24-22:12:05.055068
SID:	2033132
Source Port:	49729
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749764150322033132 02/09/24-22:13:11.591357
SID:	2033132
Source Port:	49764
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249861150322033132 02/09/24-22:14:27.636667
SID:	2033132
Source Port:	49861
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249863150322033132 02/09/24-22:14:28.963376
SID:	2033132
Source Port:	49863
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749765150322033132 02/09/24-22:13:13.044690
SID:	2033132
Source Port:	49765
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749761150322033132 02/09/24-22:13:06.852703
SID:	2033132
Source Port:	49761
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749762150322033132 02/09/24-22:13:08.501858
SID:	2033132
Source Port:	49762
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249860150322033132 02/09/24-22:14:26.991579
SID:	2033132
Source Port:	49860
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249864150322033132 02/09/24-22:14:29.601536
SID:	2033132
Source Port:	49864
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449729150322825563 02/09/24-22:12:05.169024
SID:	2825563
Source Port:	49729
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249862150322033132 02/09/24-22:14:28.291044
SID:	2033132
Source Port:	49862
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449730150322033132 02/09/24-22:12:07.540324
SID:	2033132
Source Port:	49730
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449731150322033132 02/09/24-22:12:11.454015
SID:	2033132
Source Port:	49731
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249869150322033132 02/09/24-22:14:32.772749
SID:	2033132
Source Port:	49869
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749769150322033132 02/09/24-22:13:19.345666
SID:	2033132
Source Port:	49769
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249858150322033132 02/09/24-22:14:25.713700
SID:	2033132
Source Port:	49858
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449958150322825564 02/09/24-22:15:31.285460
SID:	2825564
Source Port:	49958
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249857150322033132 02/09/24-22:14:25.099971
SID:	2033132
Source Port:	49857
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249868150322033132 02/09/24-22:14:32.135594
SID:	2033132
Source Port:	49868
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749767150322033132 02/09/24-22:13:16.789090
SID:	2033132
Source Port:	49767
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249856150322033132 02/09/24-22:14:24.484581
SID:	2033132
Source Port:	49856
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449963150322825564 02/09/24-22:15:34.410469
SID:	2825564
Source Port:	49963
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749766150322033132 02/09/24-22:13:14.485282
SID:	2033132
Source Port:	49766
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749768150322033132 02/09/24-22:13:18.107306
SID:	2033132
Source Port:	49768
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249865150322033132 02/09/24-22:14:30.217236
SID:	2033132
Source Port:	49865
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249867150322033132 02/09/24-22:14:31.488317
SID:	2033132
Source Port:	49867
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449733150322033132 02/09/24-22:12:13.804049
SID:	2033132
Source Port:	49733
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249855150322033132 02/09/24-22:14:23.834327
SID:	2033132
Source Port:	49855
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249866150322033132 02/09/24-22:14:30.856658
SID:	2033132
Source Port:	49866
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749802150322033132 02/09/24-22:13:48.096773
SID:	2033132
Source Port:	49802
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749803150322033132 02/09/24-22:13:48.810485
SID:	2033132
Source Port:	49803
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249901150322033132 02/09/24-22:14:52.818617
SID:	2033132
Source Port:	49901
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749801150322033132 02/09/24-22:13:47.389939
SID:	2033132
Source Port:	49801
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249900150322033132 02/09/24-22:14:52.186941
SID:	2033132
Source Port:	49900
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749760150322825563 02/09/24-22:13:05.416255
SID:	2825563
Source Port:	49760
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749800150322033132 02/09/24-22:13:46.695781
SID:	2033132
Source Port:	49800
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249859150322033132 02/09/24-22:14:26.346761
SID:	2033132
Source Port:	49859
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749809150322033132 02/09/24-22:13:52.900561
SID:	2033132
Source Port:	49809
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749770150322033132 02/09/24-22:13:20.551354
SID:	2033132
Source Port:	49770
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749771150322033132 02/09/24-22:13:21.738301
SID:	2033132
Source Port:	49771
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749804150322033132 02/09/24-22:13:49.479205
SID:	2033132
Source Port:	49804
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749774150322033132 02/09/24-22:13:25.047045
SID:	2033132
Source Port:	49774
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749773150322033132 02/09/24-22:13:23.970662
SID:	2033132
Source Port:	49773
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749775150322033132 02/09/24-22:13:26.101249
SID:	2033132
Source Port:	49775
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749772150322033132 02/09/24-22:13:22.866205
SID:	2033132
Source Port:	49772
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749776150322033132 02/09/24-22:13:27.118465
SID:	2033132
Source Port:	49776
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749805150322033132 02/09/24-22:13:50.160330
SID:	2033132
Source Port:	49805
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749806150322033132 02/09/24-22:13:50.872881
SID:	2033132
Source Port:	49806
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749807150322033132 02/09/24-22:13:51.542118
SID:	2033132
Source Port:	49807
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749808150322033132 02/09/24-22:13:52.221826
SID:	2033132
Source Port:	49808
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449949150322033132 02/09/24-22:15:25.384400
SID:	2033132
Source Port:	49949
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449740150322825563 02/09/24-22:12:19.380738
SID:	2825563
Source Port:	49740
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449947150322033132 02/09/24-22:15:24.144089
SID:	2033132
Source Port:	49947
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449968150322033132 02/09/24-22:15:37.296304
SID:	2033132
Source Port:	49968
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449946150322033132 02/09/24-22:15:23.519656
SID:	2033132
Source Port:	49946
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449948150322033132 02/09/24-22:15:24.769341
SID:	2033132
Source Port:	49948
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449742150322825563 02/09/24-22:12:24.650295
SID:	2825563
Source Port:	49742
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449741150322825563 02/09/24-22:12:22.006425
SID:	2825563
Source Port:	49741
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449965150322033132 02/09/24-22:15:35.432612
SID:	2033132
Source Port:	49965
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449969150322033132 02/09/24-22:15:37.915276
SID:	2033132
Source Port:	49969
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749769150322825564 02/09/24-22:13:19.610627
SID:	2825564
Source Port:	49769
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449944150322033132 02/09/24-22:15:21.525806
SID:	2033132
Source Port:	49944
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449945150322033132 02/09/24-22:15:23.169528
SID:	2033132
Source Port:	49945
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449966150322033132 02/09/24-22:15:36.035366
SID:	2033132
Source Port:	49966
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449747150322825563 02/09/24-22:12:37.809108
SID:	2825563
Source Port:	49747
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449967150322033132 02/09/24-22:15:36.674158
SID:	2033132
Source Port:	49967
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449960150322033132 02/09/24-22:15:32.292682
SID:	2033132
Source Port:	49960
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449940150322033132 02/09/24-22:15:18.876727
SID:	2033132
Source Port:	49940
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6450002150322825563 02/09/24-22:15:58.860241
SID:	2825563
Source Port:	50002
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449746150322825563 02/09/24-22:12:35.179665
SID:	2825563
Source Port:	49746
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449745150322825563 02/09/24-22:12:32.551798
SID:	2825563
Source Port:	49745
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449961150322033132 02/09/24-22:15:32.891267
SID:	2033132
Source Port:	49961
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449744150322825563 02/09/24-22:12:29.925790
SID:	2825563
Source Port:	49744
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449943150322033132 02/09/24-22:15:20.633041
SID:	2033132
Source Port:	49943
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449964150322033132 02/09/24-22:15:34.761863
SID:	2033132
Source Port:	49964
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449942150322033132 02/09/24-22:15:20.021837
SID:	2033132
Source Port:	49942
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449941150322033132 02/09/24-22:15:19.382937
SID:	2033132
Source Port:	49941
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449962150322033132 02/09/24-22:15:33.515754
SID:	2033132
Source Port:	49962
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449743150322825563 02/09/24-22:12:27.291613
SID:	2825563
Source Port:	49743
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449963150322033132 02/09/24-22:15:34.143365
SID:	2033132
Source Port:	49963
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249918150322033132 02/09/24-22:15:03.547852
SID:	2033132
Source Port:	49918
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749780150322033132 02/09/24-22:13:30.942366
SID:	2033132
Source Port:	49780
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749782150322033132 02/09/24-22:13:32.747790
SID:	2033132
Source Port:	49782
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749814150322033132 02/09/24-22:13:56.249160
SID:	2033132
Source Port:	49814
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449749150322033132 02/09/24-22:12:42.815553
SID:	2033132
Source Port:	49749
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249841150322033132 02/09/24-22:14:13.877367
SID:	2033132
Source Port:	49841
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249883150322033132 02/09/24-22:14:41.542343
SID:	2033132
Source Port:	49883
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749784150322033132 02/09/24-22:13:34.465629
SID:	2033132
Source Port:	49784
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749786150322033132 02/09/24-22:13:36.121436
SID:	2033132
Source Port:	49786
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249843150322033132 02/09/24-22:14:15.148862
SID:	2033132
Source Port:	49843
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249914150322033132 02/09/24-22:15:00.983048
SID:	2033132
Source Port:	49914
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249881150322033132 02/09/24-22:14:40.314960
SID:	2033132
Source Port:	49881
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249885150322033132 02/09/24-22:14:42.791880
SID:	2033132
Source Port:	49885
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449749150322825563 02/09/24-22:12:43.084374
SID:	2825563
Source Port:	49749
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749816150322033132 02/09/24-22:13:57.570038
SID:	2033132
Source Port:	49816
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249916150322033132 02/09/24-22:15:02.262168
SID:	2033132
Source Port:	49916
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449747150322033132 02/09/24-22:12:37.528314
SID:	2033132
Source Port:	49747
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449938150322033132 02/09/24-22:15:17.503285
SID:	2033132
Source Port:	49938
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749818150322033132 02/09/24-22:13:58.862057
SID:	2033132
Source Port:	49818
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249849150322033132 02/09/24-22:14:20.019412
SID:	2033132
Source Port:	49849
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449741150322033132 02/09/24-22:12:21.723366
SID:	2033132
Source Port:	49741
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249839150322033132 02/09/24-22:14:12.583408
SID:	2033132
Source Port:	49839
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449751150322033132 02/09/24-22:12:48.093276
SID:	2033132
Source Port:	49751
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249847150322033132 02/09/24-22:14:18.737628
SID:	2033132
Source Port:	49847
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249879150322033132 02/09/24-22:14:39.091451
SID:	2033132
Source Port:	49879
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249889150322033132 02/09/24-22:14:45.336742
SID:	2033132
Source Port:	49889
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449745150322033132 02/09/24-22:12:32.268832
SID:	2033132
Source Port:	49745
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249845150322033132 02/09/24-22:14:16.422475
SID:	2033132
Source Port:	49845
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249877150322033132 02/09/24-22:14:37.818662
SID:	2033132
Source Port:	49877
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249835150322033132 02/09/24-22:14:10.031003
SID:	2033132
Source Port:	49835
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249887150322033132 02/09/24-22:14:44.071826
SID:	2033132
Source Port:	49887
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449755150322033132 02/09/24-22:12:55.215555
SID:	2033132
Source Port:	49755
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749777150322033132 02/09/24-22:13:28.103145
SID:	2033132
Source Port:	49777
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749779150322033132 02/09/24-22:13:30.026542
SID:	2033132
Source Port:	49779
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749788150322033132 02/09/24-22:13:37.760935
SID:	2033132
Source Port:	49788
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449743150322033132 02/09/24-22:12:27.169293
SID:	2033132
Source Port:	49743
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249833150322033132 02/09/24-22:14:08.741511
SID:	2033132
Source Port:	49833
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249912150322033132 02/09/24-22:14:59.737123
SID:	2033132
Source Port:	49912
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249882150322825564 02/09/24-22:14:41.203960
SID:	2825564
Source Port:	49882
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6450002150322033132 02/09/24-22:15:58.795615
SID:	2033132
Source Port:	50002
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249910150322033132 02/09/24-22:14:58.465380
SID:	2033132
Source Port:	49910
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749812150322033132 02/09/24-22:13:54.917672
SID:	2033132
Source Port:	49812
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749823150322033132 02/09/24-22:14:02.177519
SID:	2033132
Source Port:	49823
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6450000150322033132 02/09/24-22:15:57.320689
SID:	2033132
Source Port:	50000
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249837150322033132 02/09/24-22:14:11.305759
SID:	2033132
Source Port:	49837
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749810150322033132 02/09/24-22:13:53.589871
SID:	2033132
Source Port:	49810
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749821150322033132 02/09/24-22:14:00.857452
SID:	2033132
Source Port:	49821
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249909150322033132 02/09/24-22:14:57.850069
SID:	2033132
Source Port:	49909
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249890150322033132 02/09/24-22:14:45.937717
SID:	2033132
Source Port:	49890
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449991150322033132 02/09/24-22:15:51.676224
SID:	2033132
Source Port:	49991
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249852150322033132 02/09/24-22:14:21.907671
SID:	2033132
Source Port:	49852
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249873150322033132 02/09/24-22:14:35.296123
SID:	2033132
Source Port:	49873
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249894150322033132 02/09/24-22:14:48.438381
SID:	2033132
Source Port:	49894
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249831150322033132 02/09/24-22:14:07.503641
SID:	2033132
Source Port:	49831
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449759150322033132 02/09/24-22:13:03.240333
SID:	2033132
Source Port:	49759
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249903150322033132 02/09/24-22:14:54.077716
SID:	2033132
Source Port:	49903
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449739150322825563 02/09/24-22:12:16.725609
SID:	2825563
Source Port:	49739
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249850150322033132 02/09/24-22:14:20.629868
SID:	2033132
Source Port:	49850
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249854150322033132 02/09/24-22:14:23.180801
SID:	2033132
Source Port:	49854
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249871150322033132 02/09/24-22:14:34.036022
SID:	2033132
Source Port:	49871
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249875150322033132 02/09/24-22:14:36.552674
SID:	2033132
Source Port:	49875
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249896150322033132 02/09/24-22:14:49.685144
SID:	2033132
Source Port:	49896
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249892150322033132 02/09/24-22:14:47.203586
SID:	2033132
Source Port:	49892
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449757150322033132 02/09/24-22:12:59.416646
SID:	2033132
Source Port:	49757
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249905150322033132 02/09/24-22:14:55.322144
SID:	2033132
Source Port:	49905
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249907150322033132 02/09/24-22:14:56.571056
SID:	2033132
Source Port:	49907
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449936150322033132 02/09/24-22:15:16.252129
SID:	2033132
Source Port:	49936
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449978150322033132 02/09/24-22:15:43.571979
SID:	2033132
Source Port:	49978
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449957150322033132 02/09/24-22:15:30.372830
SID:	2033132
Source Port:	49957
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449959150322033132 02/09/24-22:15:31.648522
SID:	2033132
Source Port:	49959
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449976150322033132 02/09/24-22:15:42.317143
SID:	2033132
Source Port:	49976
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449997150322033132 02/09/24-22:15:55.455002
SID:	2033132
Source Port:	49997
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449752150322825563 02/09/24-22:12:50.865934
SID:	2825563
Source Port:	49752
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449955150322033132 02/09/24-22:15:29.110273
SID:	2033132
Source Port:	49955
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449934150322033132 02/09/24-22:15:15.001004
SID:	2033132
Source Port:	49934
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449999150322033132 02/09/24-22:15:56.715373
SID:	2033132
Source Port:	49999
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449750150322825563 02/09/24-22:12:45.736211
SID:	2825563
Source Port:	49750
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449758150322825563 02/09/24-22:13:01.637665
SID:	2825563
Source Port:	49758
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449970150322033132 02/09/24-22:15:38.533574
SID:	2033132
Source Port:	49970
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449951150322033132 02/09/24-22:15:26.618074
SID:	2033132
Source Port:	49951
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449972150322033132 02/09/24-22:15:39.808799
SID:	2033132
Source Port:	49972
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449993150322033132 02/09/24-22:15:52.948649
SID:	2033132
Source Port:	49993
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449756150322825563 02/09/24-22:12:57.648959
SID:	2825563
Source Port:	49756
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449932150322033132 02/09/24-22:15:13.742161
SID:	2033132
Source Port:	49932
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449733150322825563 02/09/24-22:12:14.095345
SID:	2825563
Source Port:	49733
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449974150322033132 02/09/24-22:15:41.051269
SID:	2033132
Source Port:	49974
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449953150322033132 02/09/24-22:15:27.873612
SID:	2033132
Source Port:	49953
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449930150322033132 02/09/24-22:15:12.504473
SID:	2033132
Source Port:	49930
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449995150322033132 02/09/24-22:15:54.196845
SID:	2033132
Source Port:	49995
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249828150322033132 02/09/24-22:14:05.542781
SID:	2033132
Source Port:	49828
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249829150322033132 02/09/24-22:14:06.173453
SID:	2033132
Source Port:	49829
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749799150322033132 02/09/24-22:13:45.993074
SID:	2033132
Source Port:	49799
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249898150322033132 02/09/24-22:14:50.957730
SID:	2033132
Source Port:	49898
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249897150322033132 02/09/24-22:14:50.310241
SID:	2033132
Source Port:	49897
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249899150322033132 02/09/24-22:14:51.563600
SID:	2033132
Source Port:	49899
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449928150322825564 02/09/24-22:15:11.496905
SID:	2825564
Source Port:	49928
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249827150322033132 02/09/24-22:14:04.899767
SID:	2033132
Source Port:	49827
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249890150322825564 02/09/24-22:14:46.223642
SID:	2825564
Source Port:	49890
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749790150322033132 02/09/24-22:13:39.333098
SID:	2033132
Source Port:	49790
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749791150322033132 02/09/24-22:13:40.095025
SID:	2033132
Source Port:	49791
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749826150322033132 02/09/24-22:14:04.142855
SID:	2033132
Source Port:	49826
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749792150322033132 02/09/24-22:13:40.849504
SID:	2033132
Source Port:	49792
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749825150322033132 02/09/24-22:14:03.478957
SID:	2033132
Source Port:	49825
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749795150322033132 02/09/24-22:13:43.087531
SID:	2033132
Source Port:	49795
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749793150322033132 02/09/24-22:13:41.597332
SID:	2033132
Source Port:	49793
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749797150322033132 02/09/24-22:13:44.561738
SID:	2033132
Source Port:	49797
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749794150322033132 02/09/24-22:13:42.349844
SID:	2033132
Source Port:	49794
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749798150322033132 02/09/24-22:13:45.260898
SID:	2033132
Source Port:	49798
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449929150322033132 02/09/24-22:15:11.863674
SID:	2033132
Source Port:	49929
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449927150322033132 02/09/24-22:15:10.603445
SID:	2033132
Source Port:	49927
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449928150322033132 02/09/24-22:15:11.219074
SID:	2033132
Source Port:	49928
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749796150322033132 02/09/24-22:13:43.829629
SID:	2033132
Source Port:	49796
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449989150322033132 02/09/24-22:15:50.423352
SID:	2033132
Source Port:	49989
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449925150322033132 02/09/24-22:15:09.324630
SID:	2033132
Source Port:	49925
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449926150322033132 02/09/24-22:15:09.952476
SID:	2033132
Source Port:	49926
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449987150322033132 02/09/24-22:15:49.186603
SID:	2033132
Source Port:	49987
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449986150322033132 02/09/24-22:15:48.553357
SID:	2033132
Source Port:	49986
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449922150322033132 02/09/24-22:15:07.462426
SID:	2033132
Source Port:	49922
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449923150322033132 02/09/24-22:15:08.075146
SID:	2033132
Source Port:	49923
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449924150322033132 02/09/24-22:15:08.692607
SID:	2033132
Source Port:	49924
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449988150322033132 02/09/24-22:15:49.846541
SID:	2033132
Source Port:	49988
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449981150322033132 02/09/24-22:15:45.441894
SID:	2033132
Source Port:	49981
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449982150322033132 02/09/24-22:15:46.071527
SID:	2033132
Source Port:	49982
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449983150322033132 02/09/24-22:15:46.689639
SID:	2033132
Source Port:	49983
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449985150322033132 02/09/24-22:15:47.933359
SID:	2033132
Source Port:	49985
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449921150322033132 02/09/24-22:15:06.819261
SID:	2033132
Source Port:	49921
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449920150322033132 02/09/24-22:15:06.225141
SID:	2033132
Source Port:	49920
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449984150322033132 02/09/24-22:15:47.307585
SID:	2033132
Source Port:	49984
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249919150322033132 02/09/24-22:15:05.716968
SID:	2033132
Source Port:	49919
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249880150322033132 02/09/24-22:14:39.695363
SID:	2033132
Source Port:	49880
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6450000150322825564 02/09/24-22:15:57.603132
SID:	2825564
Source Port:	50000
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749815150322033132 02/09/24-22:13:56.908864
SID:	2033132
Source Port:	49815
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449980150322033132 02/09/24-22:15:44.827318
SID:	2033132
Source Port:	49980
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249913150322033132 02/09/24-22:15:00.371843
SID:	2033132
Source Port:	49913
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749781150322033132 02/09/24-22:13:31.855494
SID:	2033132
Source Port:	49781
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449748150322825563 02/09/24-22:12:40.455149
SID:	2825563
Source Port:	49748
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249884150322033132 02/09/24-22:14:42.168705
SID:	2033132
Source Port:	49884
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449748150322033132 02/09/24-22:12:40.173961
SID:	2033132
Source Port:	49748
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249882150322033132 02/09/24-22:14:40.923481
SID:	2033132
Source Port:	49882
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249886150322033132 02/09/24-22:14:43.412742
SID:	2033132
Source Port:	49886
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249842150322033132 02/09/24-22:14:14.495826
SID:	2033132
Source Port:	49842
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249915150322033132 02/09/24-22:15:01.617601
SID:	2033132
Source Port:	49915
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749783150322033132 02/09/24-22:13:33.615235
SID:	2033132
Source Port:	49783
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749787150322033132 02/09/24-22:13:36.945033
SID:	2033132
Source Port:	49787
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749817150322033132 02/09/24-22:13:58.203064
SID:	2033132
Source Port:	49817
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249887150322825564 02/09/24-22:14:44.343068
SID:	2825564
Source Port:	49887
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449746150322033132 02/09/24-22:12:34.897710
SID:	2033132
Source Port:	49746
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449939150322033132 02/09/24-22:15:18.119215
SID:	2033132
Source Port:	49939
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749819150322033132 02/09/24-22:13:59.538281
SID:	2033132
Source Port:	49819
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249840150322033132 02/09/24-22:14:13.228596
SID:	2033132
Source Port:	49840
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249917150322033132 02/09/24-22:15:02.875445
SID:	2033132
Source Port:	49917
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749785150322033132 02/09/24-22:13:35.285168
SID:	2033132
Source Port:	49785
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449752150322033132 02/09/24-22:12:50.596394
SID:	2033132
Source Port:	49752
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449742150322033132 02/09/24-22:12:24.370492
SID:	2033132
Source Port:	49742
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249838150322033132 02/09/24-22:14:11.941691
SID:	2033132
Source Port:	49838
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249836150322033132 02/09/24-22:14:10.674906
SID:	2033132
Source Port:	49836
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249846150322033132 02/09/24-22:14:18.391742
SID:	2033132
Source Port:	49846
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449756150322033132 02/09/24-22:12:57.376284
SID:	2033132
Source Port:	49756
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749778150322033132 02/09/24-22:13:29.104971
SID:	2033132
Source Port:	49778
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249834150322033132 02/09/24-22:14:09.383518
SID:	2033132
Source Port:	49834
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249888150322033132 02/09/24-22:14:44.697077
SID:	2033132
Source Port:	49888
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449744150322033132 02/09/24-22:12:29.652728
SID:	2033132
Source Port:	49744
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249876150322033132 02/09/24-22:14:37.189327
SID:	2033132
Source Port:	49876
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249878150322033132 02/09/24-22:14:38.450202
SID:	2033132
Source Port:	49878
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449754150322033132 02/09/24-22:12:52.954248
SID:	2033132
Source Port:	49754
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249844150322033132 02/09/24-22:14:15.780205
SID:	2033132
Source Port:	49844
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749789150322033132 02/09/24-22:13:38.630867
SID:	2033132
Source Port:	49789
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749813150322033132 02/09/24-22:13:55.583165
SID:	2033132
Source Port:	49813
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749822150322033132 02/09/24-22:14:01.516334
SID:	2033132
Source Port:	49822
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749824150322033132 02/09/24-22:14:02.822123
SID:	2033132
Source Port:	49824
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249911150322033132 02/09/24-22:14:59.102209
SID:	2033132
Source Port:	49911
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749820150322033132 02/09/24-22:14:00.179713
SID:	2033132
Source Port:	49820
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449750150322033132 02/09/24-22:12:45.447291
SID:	2033132
Source Port:	49750
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.122.107

Timestamp:	192.168.2.43.6.122.10749811150322033132 02/09/24-22:13:54.245406
SID:	2033132
Source Port:	49811
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449740150322033132 02/09/24-22:12:19.091730
SID:	2033132
Source Port:	49740
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249848150322033132 02/09/24-22:14:19.371205
SID:	2033132
Source Port:	49848
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6450001150322033132 02/09/24-22:15:57.949710
SID:	2033132
Source Port:	50001
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249908150322033132 02/09/24-22:14:57.205033
SID:	2033132
Source Port:	49908
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249891150322033132 02/09/24-22:14:46.567107
SID:	2033132
Source Port:	49891
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249870150322033132 02/09/24-22:14:33.403010
SID:	2033132
Source Port:	49870
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249902150322033132 02/09/24-22:14:53.460527
SID:	2033132
Source Port:	49902
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449739150322033132 02/09/24-22:12:16.446955
SID:	2033132
Source Port:	49739
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249830150322033132 02/09/24-22:14:06.815335
SID:	2033132
Source Port:	49830
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249872150322033132 02/09/24-22:14:34.669327
SID:	2033132
Source Port:	49872
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249874150322033132 02/09/24-22:14:35.927653
SID:	2033132
Source Port:	49874
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249895150322033132 02/09/24-22:14:49.055994
SID:	2033132
Source Port:	49895
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449759150322825563 02/09/24-22:13:03.509386
SID:	2825563
Source Port:	49759
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449990150322033132 02/09/24-22:15:51.052510
SID:	2033132
Source Port:	49990
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249832150322033132 02/09/24-22:14:08.093237
SID:	2033132
Source Port:	49832
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249893150322033132 02/09/24-22:14:47.823297
SID:	2033132
Source Port:	49893
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249853150322033132 02/09/24-22:14:22.549864
SID:	2033132
Source Port:	49853
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249904150322033132 02/09/24-22:14:54.697300
SID:	2033132
Source Port:	49904
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449758150322033132 02/09/24-22:13:01.380495
SID:	2033132
Source Port:	49758
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249851150322033132 02/09/24-22:14:21.279507
SID:	2033132
Source Port:	49851
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.98.232

Timestamp:	192.168.2.43.6.98.23249906150322033132 02/09/24-22:14:55.948386
SID:	2033132
Source Port:	49906
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449730150322825563 02/09/24-22:12:07.800248
SID:	2825563
Source Port:	49730
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449979150322033132 02/09/24-22:15:44.200180
SID:	2033132
Source Port:	49979
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449935150322033132 02/09/24-22:15:15.634356
SID:	2033132
Source Port:	49935
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449937150322033132 02/09/24-22:15:16.891844
SID:	2033132
Source Port:	49937
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449751150322825563 02/09/24-22:12:48.367907
SID:	2825563
Source Port:	49751
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449998150322033132 02/09/24-22:15:56.071461
SID:	2033132
Source Port:	49998
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449954150322033132 02/09/24-22:15:28.524284
SID:	2033132
Source Port:	49954
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449958150322033132 02/09/24-22:15:30.994596
SID:	2033132
Source Port:	49958
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449933150322033132 02/09/24-22:15:14.380389
SID:	2033132
Source Port:	49933
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449977150322033132 02/09/24-22:15:42.958157
SID:	2033132
Source Port:	49977
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449956150322033132 02/09/24-22:15:29.739104
SID:	2033132
Source Port:	49956
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449992150322033132 02/09/24-22:15:52.295563
SID:	2033132
Source Port:	49992
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449971150322033132 02/09/24-22:15:39.170811
SID:	2033132
Source Port:	49971
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449757150322825563 02/09/24-22:12:59.682819
SID:	2825563
Source Port:	49757
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449994150322033132 02/09/24-22:15:53.567362
SID:	2033132
Source Port:	49994
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449950150322033132 02/09/24-22:15:25.995375
SID:	2033132
Source Port:	49950
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449996150322033132 02/09/24-22:15:54.830912
SID:	2033132
Source Port:	49996
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449975150322033132 02/09/24-22:15:41.710369
SID:	2033132
Source Port:	49975
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449931150322033132 02/09/24-22:15:13.110090
SID:	2033132
Source Port:	49931
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449755150322825563 02/09/24-22:12:55.494635
SID:	2825563
Source Port:	49755
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449973150322033132 02/09/24-22:15:40.435805
SID:	2033132
Source Port:	49973
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.4 - Destination IP: 3.6.115.64

Timestamp:	192.168.2.43.6.115.6449952150322033132 02/09/24-22:15:27.235300
SID:	2033132
Source Port:	49952
Destination Port:	15032
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ae6T8jJueq.exe

Avira: detected

Antivirus detection for URL or domain

Source: 0.tcp.in.ngrok.io:15032

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.4066419425.00000000027B3000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Njrat {"Host": "0.tcp.in.ngrok.io:15032", "Campaign ID": "powerchang", "Install Name": "ae6T8jJueq.exe", "Install Dir": "Desktop"}

Multi AV Scanner detection for submitted file

Source: ae6T8jJueq.exe

ReversingLabs: Detection: 86%

Yara detected Njrat

Source: Yara match	File source: ae6T8jJueq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ae6T8jJueq.exe PID: 6336, type: MEMORYSTR

Machine Learning detection for sample

Source: ae6T8jJueq.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: ae6T8jJueq.exe	String decryptor: 47(;C
Source: ae6T8jJueq.exe	String decryptor: " & 9";
Source: ae6T8jJueq.exe	String decryptor: bZVGE
Source: ae6T8jJueq.exe	String decryptor: PPTJUHWFX[Y[C^A@_CBFBXGVIT
Source: ae6T8jJueq.exe	String decryptor: sMCEUAWO
Source: ae6T8jJueq.exe	String decryptor: rVNMP^PY
Source: ae6T8jJueq.exe	String decryptor: 0(!q(96

Source: ae6T8jJueq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: ae6T8jJueq.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49729 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49729 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49730 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49730 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49731 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49733 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49733 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49739 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49739 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49740 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49740 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49741 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49741 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49742 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49742 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49743 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49743 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49744 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49744 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49745 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49745 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49746 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49746 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49747 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49747 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49748 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49748 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49749 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49749 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49750 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49750 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49751 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49751 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49752 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49752 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49754 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49755 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49755 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49756 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49756 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49757 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49757 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49758 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49758 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49759 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49759 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49760 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:49760 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49761 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49762 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49763 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49764 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49765 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49766 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49767 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49768 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49769 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49769 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49770 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49771 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49772 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49773 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49774 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49775 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49776 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49777 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49778 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49779 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49780 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49781 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49782 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49783 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49784 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49785 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49786 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49787 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49788 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49789 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49790 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49791 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49792 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49793 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49794 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49795 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49796 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49797 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49798 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49799 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49800 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49801 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49802 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49803 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49804 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49805 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49806 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49807 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49808 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49809 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49810 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49811 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49812 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49813 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49814 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49815 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49816 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49817 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49818 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49819 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49820 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49821 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49822 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49823 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49824 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49825 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49826 -> 3.6.122.107:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49827 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49828 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49829 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49830 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49831 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49832 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49833 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49834 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49835 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49836 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49837 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49838 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49839 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49840 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49841 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49842 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49843 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49844 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49845 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49846 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49847 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49848 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49849 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49850 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49851 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49852 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49853 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49854 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49855 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49856 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49857 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49858 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49859 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49860 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49861 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49862 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49863 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49864 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49865 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49866 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49867 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49868 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49869 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49870 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49871 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49872 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49873 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49874 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49875 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49876 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49877 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49878 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49879 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49880 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49881 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49882 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49882 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49883 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49884 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49885 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49886 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49887 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49887 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49888 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49889 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49890 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49890 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49891 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49892 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49893 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49894 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49895 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49896 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49897 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49898 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49899 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49900 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49901 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49902 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49903 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49904 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49905 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49906 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49907 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49908 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49909 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49910 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49911 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49912 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49913 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49914 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49915 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49916 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49917 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49918 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49919 -> 3.6.98.232:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49920 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49921 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49922 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49923 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49924 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49925 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49926 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49927 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49928 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49928 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49929 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49930 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49931 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49932 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49933 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49934 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49935 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49936 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49937 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49938 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49939 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49940 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49941 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49942 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49943 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49944 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49945 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49946 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49947 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49948 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49949 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49950 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49951 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49952 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49953 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49954 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49955 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49956 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49957 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49958 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49958 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49959 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49960 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49961 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49962 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49963 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:49963 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49964 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49965 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49966 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49967 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49968 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49969 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49970 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49971 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49972 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49973 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49974 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49975 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49976 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49977 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49978 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49979 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49980 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49981 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49982 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49983 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49984 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49985 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49986 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49987 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49988 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49989 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49990 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49991 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49992 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49993 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49994 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49995 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49996 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49997 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49998 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:49999 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:50000 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.4:50000 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:50001 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.4:50002 -> 3.6.115.64:15032
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.4:50002 -> 3.6.115.64:15032

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 0.tcp.in.ngrok.io:15032

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 3.6.122.107 ports 15032,0,1,2,3,5
Source: global traffic	TCP traffic: 3.6.98.232 ports 15032,0,1,2,3,5
Source: global traffic	TCP traffic: 3.6.115.64 ports 15032,0,1,2,3,5

Yara detected Generic Downloader

Source: Yara match	File source: ae6T8jJueq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE

Source: global traffic	TCP traffic: 192.168.2.4:49729 -> 3.6.115.64:15032
Source: global traffic	TCP traffic: 192.168.2.4:49760 -> 3.6.122.107:15032
Source: global traffic	TCP traffic: 192.168.2.4:49827 -> 3.6.98.232:15032

Source: Joe Sandbox View	IP Address: 3.6.122.107 3.6.122.107
Source: Joe Sandbox View	IP Address: 3.6.115.64 3.6.115.64
Source: Joe Sandbox View	IP Address: 3.6.98.232 3.6.98.232

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Code function: 0_2_00A2A09A recv,

0_2_00A2A09A

Source: unknown

DNS traffic detected: queries for: 0.tcp.in.ngrok.io

Source: ae6T8jJueq.exe, 00000000.00000002.4065784069.0000000000613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.
Source: ae6T8jJueq.exe, 00000000.00000002.4065784069.0000000000613000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.LinkId=42127
Source: ae6T8jJueq.exe	String found in binary or memory: https://pastebin.com/raw/EngADTbC

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: ae6T8jJueq.exe, Form1.cs	.Net Code: SetHook
Source: ae6T8jJueq.exe, kl.cs	.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: ae6T8jJueq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ae6T8jJueq.exe PID: 6336, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: Detects unknown malware sample with pastebin RAW URL Author: Florian Roth
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: Detects unknown malware sample with pastebin RAW URL Author: Florian Roth
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: detects Windows exceutables potentially bypassing UAC using eventvwr.exe Author: ditekSHen
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Code function: 0_2_0491199A

0_2_0491199A

Source: ae6T8jJueq.exe, 00000000.00000002.4065784069.00000000005DE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs ae6T8jJueq.exe

Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Section loaded: sxs.dll	Jump to behavior

Source: ae6T8jJueq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: Unknown_Malware_Sample_Jul17_2 date = 2017-08-01, hash1 = 3530d480db082af1823a7eb236203aca24dc3685f08c301466909f0794508a52, author = Florian Roth, description = Detects unknown malware sample with pastebin RAW URL, reference = https://goo.gl/iqH8CK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: ae6T8jJueq.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: Unknown_Malware_Sample_Jul17_2 date = 2017-08-01, hash1 = 3530d480db082af1823a7eb236203aca24dc3685f08c301466909f0794508a52, author = Florian Roth, description = Detects unknown malware sample with pastebin RAW URL, reference = https://goo.gl/iqH8CK, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer author = ditekSHen, description = detects Windows exceutables potentially bypassing UAC using eventvwr.exe
Source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@1/0@4/3

Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Code function: 0_2_04AF24FE AdjustTokenPrivileges,		0_2_04AF24FE
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Code function: 0_2_04AF24C7 AdjustTokenPrivileges,		0_2_04AF24C7

Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Mutant created: \Sessions\1\BaseNamedObjects\Neeles.exe
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: ae6T8jJueq.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: ae6T8jJueq.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ae6T8jJueq.exe

ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: ae6T8jJueq.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: ae6T8jJueq.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: ae6T8jJueq.exe, OK.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Code function: 0_2_00A22DB5 pushad ; retf

0_2_00A22DB6

Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: ae6T8jJueq.exe

Binary or memory string: WIRESHARK.EXE

Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Memory allocated: BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Memory allocated: 26F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Memory allocated: 46F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Window / User API: threadDelayed 3693	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Window / User API: threadDelayed 5504	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Window / User API: foregroundWindowGot 1771	Jump to behavior

Source: C:\Users\user\Desktop\ae6T8jJueq.exe TID: 6312	Thread sleep count: 167 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe TID: 6312	Thread sleep time: -167000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe TID: 6676	Thread sleep count: 3693 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe TID: 6312	Thread sleep count: 5504 > 30	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe TID: 6312	Thread sleep time: -5504000s >= -30000s	Jump to behavior

Source: ae6T8jJueq.exe	Binary or memory string: VBoxServiceM{00AAC56B-CD44-11d0-8CC2-00C04FC295EE}
Source: ae6T8jJueq.exe, 00000000.00000002.4065784069.0000000000613000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll"

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: ae6T8jJueq.exe, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: ae6T8jJueq.exe, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: ae6T8jJueq.exe, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Source: ae6T8jJueq.exe, 00000000.00000002.4066419425.00000000027B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager\O#l
Source: ae6T8jJueq.exe, 00000000.00000002.4066419425.00000000027B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: ae6T8jJueq.exe	Binary or memory string: Shell_TrayWnd
Source: ae6T8jJueq.exe	Binary or memory string: Progman!ChamaFrmTerrorrr
Source: ae6T8jJueq.exe, 00000000.00000002.4066419425.00000000027B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9#l

Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables zone checking for all users

Source: C:\Users\user\Desktop\ae6T8jJueq.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Source: ae6T8jJueq.exe, 00000000.00000002.4067979229.00000000055E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: or\MsMpeng.exe
Source: ae6T8jJueq.exe, 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, ae6T8jJueq.exe, 00000000.00000002.4066419425.00000000026F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Wireshark.exe
Source: ae6T8jJueq.exe, 00000000.00000002.4067979229.000000000556E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r\MsMpeng.exe
Source: ae6T8jJueq.exe, 00000000.00000002.4067979229.00000000055B9000.00000004.00000020.00020000.00000000.sdmp, ae6T8jJueq.exe, 00000000.00000002.4067979229.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, ae6T8jJueq.exe, 00000000.00000002.4067979229.000000000556E000.00000004.00000020.00020000.00000000.sdmp, ae6T8jJueq.exe, 00000000.00000002.4065784069.0000000000690000.00000004.00000020.00020000.00000000.sdmp, ae6T8jJueq.exe, 00000000.00000002.4065784069.0000000000613000.00000004.00000020.00020000.00000000.sdmp, ae6T8jJueq.exe, 00000000.00000002.4067943618.0000000005550000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: ae6T8jJueq.exe, 00000000.00000002.4067979229.000000000556E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\ae6T8jJueq.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: ae6T8jJueq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ae6T8jJueq.exe PID: 6336, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: ae6T8jJueq.exe, type: SAMPLE
Source: Yara match	File source: 0.0.ae6T8jJueq.exe.110000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ae6T8jJueq.exe PID: 6336, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	2 Virtualization/Sandbox Evasion	1 Input Capture	121 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 Process Injection	11 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
ae6T8jJueq.exe	86%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
ae6T8jJueq.exe	100%	Avira	TR/Dropper.Gen
ae6T8jJueq.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://go.microsoft.	0%	URL Reputation	safe
0.tcp.in.ngrok.io:15032	100%	Avira URL Cloud	malware
http://go.microsoft.LinkId=42127	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
0.tcp.in.ngrok.io	3.6.115.64	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
0.tcp.in.ngrok.io:15032	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://go.microsoft.	ae6T8jJueq.exe, 00000000.00000002.4065784069.0000000000613000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://pastebin.com/raw/EngADTbC	ae6T8jJueq.exe	false		high
http://go.microsoft.LinkId=42127	ae6T8jJueq.exe, 00000000.00000002.4065784069.0000000000613000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.6.122.107	unknown	United States	16509	AMAZON-02US	true
3.6.115.64	0.tcp.in.ngrok.io	United States	16509	AMAZON-02US	true
3.6.98.232	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1390011
Start date and time:	2024-02-09 22:11:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ae6T8jJueq.exe renamed because original name is a hash value
Original Sample Name:	3F3186F4BE8DF39294C1A53F1CD22214.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@1/0@4/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 86 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: ae6T8jJueq.exe

Simulations

Behavior and APIs

Time	Type	Description
22:12:04	API Interceptor	1148088x Sleep call for process: ae6T8jJueq.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.6.122.107	RN2vknsx6G.exe	Get hash	malicious	RedLine	Browse	0.tcp.in.ngrok.io:17440/
3.6.115.64	nOZ2Oqnzbz.exe	Get hash	malicious	Njrat	Browse
	ZB7Ot9MOic.exe	Get hash	malicious	Njrat	Browse
	etJZk4UQhS.exe	Get hash	malicious	Njrat	Browse
	jango.exe	Get hash	malicious	XWorm	Browse
	cracksetup.exe	Get hash	malicious	Nanocore	Browse
	LocalStaFvjUblU.exe	Get hash	malicious	njRat	Browse
	558EofiXYO.exe	Get hash	malicious	njRat	Browse
	JsYdl3ZkOA.exe	Get hash	malicious	njRat	Browse
	ehqsU9jDFb.exe	Get hash	malicious	njRat	Browse
	EADSXus8Cw.exe	Get hash	malicious	njRat	Browse
3.6.98.232	nOZ2Oqnzbz.exe	Get hash	malicious	Njrat	Browse
	iR2UtZj5vP.exe	Get hash	malicious	Njrat	Browse
	ZB7Ot9MOic.exe	Get hash	malicious	Njrat	Browse
	etJZk4UQhS.exe	Get hash	malicious	Njrat	Browse
	jango.exe	Get hash	malicious	XWorm	Browse
	cracksetup.exe	Get hash	malicious	Nanocore	Browse
	LocalStaFvjUblU.exe	Get hash	malicious	njRat	Browse
	JsYdl3ZkOA.exe	Get hash	malicious	njRat	Browse
	ehqsU9jDFb.exe	Get hash	malicious	njRat	Browse
	EADSXus8Cw.exe	Get hash	malicious	njRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
0.tcp.in.ngrok.io	nOZ2Oqnzbz.exe	Get hash	malicious	Njrat	Browse	3.6.115.64
	iR2UtZj5vP.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	ZB7Ot9MOic.exe	Get hash	malicious	Njrat	Browse	3.6.30.85
	etJZk4UQhS.exe	Get hash	malicious	Njrat	Browse	3.6.122.107
	jango.exe	Get hash	malicious	XWorm	Browse	3.6.30.85
	cracksetup.exe	Get hash	malicious	Nanocore	Browse	3.6.98.232
	LocalStaFvjUblU.exe	Get hash	malicious	njRat	Browse	3.6.122.107
	558EofiXYO.exe	Get hash	malicious	njRat	Browse	3.6.115.64
	JsYdl3ZkOA.exe	Get hash	malicious	njRat	Browse	3.6.115.64
	ehqsU9jDFb.exe	Get hash	malicious	njRat	Browse	3.6.115.182

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://app.capacities.io/home/9f14f34c-fd5f-47e6-a1b5-2234f076bad3	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	99.84.191.6
	https://new.express.adobe.com/webpage/qPIo2mSTEVNlt	Get hash	malicious	HTMLPhisher	Browse	108.156.152.8
	http://www.dropbox.com/scl/fi/64byq4ev8iipdzxacwzvh/February-9-2024-UPDATE.pdf?rlkey=knfkevopeov5jyeuqqsq9ordo&dl=0	Get hash	malicious	HTMLPhisher	Browse	99.84.191.24
	https://newsheater.com/2024/02/08/worthington-steel-inc-ws-shares-rise-despite-market-challenges/	Get hash	malicious	Unknown	Browse	54.202.109.213
	https://click.sleadtrack.com/link?messageId=%3Csw-98cdbf59-e981-4c99-a91f-81bd3ca8f4d0%40nodayswasted.org%3E&url=https%3A%2F%2Fnodayswasted.co%2F	Get hash	malicious	Unknown	Browse	3.162.129.245
	https://www.canva.com/design/DAF8OGGfhO8/R6YCNNVrsg2_7X2EE7u58g/view?utm_c_ontent_=DAF8OGGfhO8&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	52.88.227.35
	https://www.accountservicing.com/payment	Get hash	malicious	Unknown	Browse	54.239.153.200
	ACH#37836.htm	Get hash	malicious	HTMLPhisher	Browse	108.156.152.4
	https://indd.adobe.com/view/b79cae01-8ca2-4378-91bf-3079562443e7	Get hash	malicious	Unknown	Browse	99.86.229.14
	https://80rb.app.link/?~channel=Web--Direct&~feature=Cms&~campaign=AppBanner&~tags=locale%3Dfr_FR&~tags=version%3D1&~tags=target%3Dios&$ios_url=https%3A%2F%2Fitunes.apple.com%2FFR%2Fapp%2Fthetrainline%2Fid599502670&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=istanbulrehber%E3%80%82gen.tr/dev/css/tfcyyfxpck/YWxleC5ibGFuY29AdmFudGFnZXJpc2suY29t#%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojot	Get hash	malicious	Unknown	Browse	52.85.132.50
AMAZON-02US	https://app.capacities.io/home/9f14f34c-fd5f-47e6-a1b5-2234f076bad3	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	99.84.191.6
	https://new.express.adobe.com/webpage/qPIo2mSTEVNlt	Get hash	malicious	HTMLPhisher	Browse	108.156.152.8
	http://www.dropbox.com/scl/fi/64byq4ev8iipdzxacwzvh/February-9-2024-UPDATE.pdf?rlkey=knfkevopeov5jyeuqqsq9ordo&dl=0	Get hash	malicious	HTMLPhisher	Browse	99.84.191.24
	https://newsheater.com/2024/02/08/worthington-steel-inc-ws-shares-rise-despite-market-challenges/	Get hash	malicious	Unknown	Browse	54.202.109.213
	https://click.sleadtrack.com/link?messageId=%3Csw-98cdbf59-e981-4c99-a91f-81bd3ca8f4d0%40nodayswasted.org%3E&url=https%3A%2F%2Fnodayswasted.co%2F	Get hash	malicious	Unknown	Browse	3.162.129.245
	https://www.canva.com/design/DAF8OGGfhO8/R6YCNNVrsg2_7X2EE7u58g/view?utm_c_ontent_=DAF8OGGfhO8&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	52.88.227.35
	https://www.accountservicing.com/payment	Get hash	malicious	Unknown	Browse	54.239.153.200
	ACH#37836.htm	Get hash	malicious	HTMLPhisher	Browse	108.156.152.4
	https://indd.adobe.com/view/b79cae01-8ca2-4378-91bf-3079562443e7	Get hash	malicious	Unknown	Browse	99.86.229.14
	https://80rb.app.link/?~channel=Web--Direct&~feature=Cms&~campaign=AppBanner&~tags=locale%3Dfr_FR&~tags=version%3D1&~tags=target%3Dios&$ios_url=https%3A%2F%2Fitunes.apple.com%2FFR%2Fapp%2Fthetrainline%2Fid599502670&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=istanbulrehber%E3%80%82gen.tr/dev/css/tfcyyfxpck/YWxleC5ibGFuY29AdmFudGFnZXJpc2suY29t#%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojot	Get hash	malicious	Unknown	Browse	52.85.132.50
AMAZON-02US	https://app.capacities.io/home/9f14f34c-fd5f-47e6-a1b5-2234f076bad3	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	99.84.191.6
	https://new.express.adobe.com/webpage/qPIo2mSTEVNlt	Get hash	malicious	HTMLPhisher	Browse	108.156.152.8
	http://www.dropbox.com/scl/fi/64byq4ev8iipdzxacwzvh/February-9-2024-UPDATE.pdf?rlkey=knfkevopeov5jyeuqqsq9ordo&dl=0	Get hash	malicious	HTMLPhisher	Browse	99.84.191.24
	https://newsheater.com/2024/02/08/worthington-steel-inc-ws-shares-rise-despite-market-challenges/	Get hash	malicious	Unknown	Browse	54.202.109.213
	https://click.sleadtrack.com/link?messageId=%3Csw-98cdbf59-e981-4c99-a91f-81bd3ca8f4d0%40nodayswasted.org%3E&url=https%3A%2F%2Fnodayswasted.co%2F	Get hash	malicious	Unknown	Browse	3.162.129.245
	https://www.canva.com/design/DAF8OGGfhO8/R6YCNNVrsg2_7X2EE7u58g/view?utm_c_ontent_=DAF8OGGfhO8&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	HTMLPhisher	Browse	52.88.227.35
	https://www.accountservicing.com/payment	Get hash	malicious	Unknown	Browse	54.239.153.200
	ACH#37836.htm	Get hash	malicious	HTMLPhisher	Browse	108.156.152.4
	https://indd.adobe.com/view/b79cae01-8ca2-4378-91bf-3079562443e7	Get hash	malicious	Unknown	Browse	99.86.229.14
	https://80rb.app.link/?~channel=Web--Direct&~feature=Cms&~campaign=AppBanner&~tags=locale%3Dfr_FR&~tags=version%3D1&~tags=target%3Dios&$ios_url=https%3A%2F%2Fitunes.apple.com%2FFR%2Fapp%2Fthetrainline%2Fid599502670&$ios_deepview=false&$ios_passive_deepview=false&$fallback_url=istanbulrehber%E3%80%82gen.tr/dev/css/tfcyyfxpck/YWxleC5ibGFuY29AdmFudGFnZXJpc2suY29t#%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojotap%3C/STRONG%3E%3C/FONT%3E%3CFONT%20id=%7Bdvojotap%7D%3E%3CSTRONG%3Edvojot	Get hash	malicious	Unknown	Browse	52.85.132.50

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.546225995643068
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	ae6T8jJueq.exe
File size:	134'656 bytes
MD5:	3f3186f4be8df39294c1a53f1cd22214
SHA1:	a312a3bb6eb240ade59f390e551a68f6c93ff4da
SHA256:	73dcc6e8f005fafcfedfb31d8465ba9f51cebe4b359f5b931765d3af5c10fa05
SHA512:	ce311698152669ff68e27bb73c0cf0595a78d61f52bbf3b8d7d5fda56c77d3be38dda12a88e24c767147043cb204d9af3e78d6f1d134983d80abbb349519b81f
SSDEEP:	3072:jAosPoN36tCQviFC5EBnFfWl9zraF9bKYvMEwV8vI2EAOsV1/PPMCETO:j6t9zOvMVVQ
TLSH:	94D3294677495BC2E46C2A3610AEE6328630AC136A52E27BB4C13D6F77F5E815B037D3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...yT.e................................. ... ....@.. .......................`............@................................

File Icon


Icon Hash:	e4d0d0d4f0f0b079

Static PE Info

General

Entrypoint:	0x411bfe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65C25479 [Tue Feb 6 15:47:05 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11bb0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x10b0c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xfc04	0xfe00	93d696346fe4b65f4690c9a9319f21d8	False	0.4702263779527559	data	5.845056466030733	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x10b0c	0x10c00	c0d7e9c71b45d65dfafd39784505e55f	False	0.36610890858208955	data	4.617566485988941	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x24000	0xc	0x200	18277aed0b0fcb94d8d2aea540e0ba74	False	0.041015625	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x120e8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	0.36518100082810834
RT_GROUP_ICON	0x22910	0x14	data	1.0
RT_MANIFEST	0x22924	0x1e7	XML 1.0 document, ASCII text, with CRLF line terminators	0.5338809034907598

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.43.6.122.10749760150322033132 02/09/24-22:13:05.137013	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49760	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749763150322033132 02/09/24-22:13:10.067278	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49763	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449729150322033132 02/09/24-22:12:05.055068	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49729	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749764150322033132 02/09/24-22:13:11.591357	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49764	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249861150322033132 02/09/24-22:14:27.636667	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49861	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249863150322033132 02/09/24-22:14:28.963376	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49863	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749765150322033132 02/09/24-22:13:13.044690	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49765	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749761150322033132 02/09/24-22:13:06.852703	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49761	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749762150322033132 02/09/24-22:13:08.501858	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49762	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249860150322033132 02/09/24-22:14:26.991579	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49860	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249864150322033132 02/09/24-22:14:29.601536	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49864	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449729150322825563 02/09/24-22:12:05.169024	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49729	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249862150322033132 02/09/24-22:14:28.291044	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49862	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449730150322033132 02/09/24-22:12:07.540324	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49730	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449731150322033132 02/09/24-22:12:11.454015	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49731	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249869150322033132 02/09/24-22:14:32.772749	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49869	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749769150322033132 02/09/24-22:13:19.345666	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49769	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249858150322033132 02/09/24-22:14:25.713700	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49858	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449958150322825564 02/09/24-22:15:31.285460	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49958	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249857150322033132 02/09/24-22:14:25.099971	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49857	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249868150322033132 02/09/24-22:14:32.135594	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49868	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749767150322033132 02/09/24-22:13:16.789090	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49767	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249856150322033132 02/09/24-22:14:24.484581	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49856	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449963150322825564 02/09/24-22:15:34.410469	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49963	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749766150322033132 02/09/24-22:13:14.485282	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49766	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749768150322033132 02/09/24-22:13:18.107306	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49768	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249865150322033132 02/09/24-22:14:30.217236	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49865	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249867150322033132 02/09/24-22:14:31.488317	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49867	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449733150322033132 02/09/24-22:12:13.804049	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49733	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249855150322033132 02/09/24-22:14:23.834327	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49855	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249866150322033132 02/09/24-22:14:30.856658	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49866	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749802150322033132 02/09/24-22:13:48.096773	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49802	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749803150322033132 02/09/24-22:13:48.810485	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49803	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249901150322033132 02/09/24-22:14:52.818617	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49901	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749801150322033132 02/09/24-22:13:47.389939	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49801	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249900150322033132 02/09/24-22:14:52.186941	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49900	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749760150322825563 02/09/24-22:13:05.416255	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49760	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749800150322033132 02/09/24-22:13:46.695781	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49800	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249859150322033132 02/09/24-22:14:26.346761	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49859	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749809150322033132 02/09/24-22:13:52.900561	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49809	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749770150322033132 02/09/24-22:13:20.551354	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49770	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749771150322033132 02/09/24-22:13:21.738301	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49771	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749804150322033132 02/09/24-22:13:49.479205	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49804	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749774150322033132 02/09/24-22:13:25.047045	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49774	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749773150322033132 02/09/24-22:13:23.970662	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49773	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749775150322033132 02/09/24-22:13:26.101249	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49775	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749772150322033132 02/09/24-22:13:22.866205	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49772	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749776150322033132 02/09/24-22:13:27.118465	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49776	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749805150322033132 02/09/24-22:13:50.160330	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49805	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749806150322033132 02/09/24-22:13:50.872881	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49806	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749807150322033132 02/09/24-22:13:51.542118	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49807	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749808150322033132 02/09/24-22:13:52.221826	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49808	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449949150322033132 02/09/24-22:15:25.384400	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49949	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449740150322825563 02/09/24-22:12:19.380738	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49740	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449947150322033132 02/09/24-22:15:24.144089	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49947	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449968150322033132 02/09/24-22:15:37.296304	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49968	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449946150322033132 02/09/24-22:15:23.519656	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49946	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449948150322033132 02/09/24-22:15:24.769341	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49948	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449742150322825563 02/09/24-22:12:24.650295	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49742	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449741150322825563 02/09/24-22:12:22.006425	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49741	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449965150322033132 02/09/24-22:15:35.432612	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49965	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449969150322033132 02/09/24-22:15:37.915276	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49969	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749769150322825564 02/09/24-22:13:19.610627	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49769	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449944150322033132 02/09/24-22:15:21.525806	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49944	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449945150322033132 02/09/24-22:15:23.169528	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49945	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449966150322033132 02/09/24-22:15:36.035366	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49966	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449747150322825563 02/09/24-22:12:37.809108	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49747	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449967150322033132 02/09/24-22:15:36.674158	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49967	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449960150322033132 02/09/24-22:15:32.292682	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49960	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449940150322033132 02/09/24-22:15:18.876727	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49940	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6450002150322825563 02/09/24-22:15:58.860241	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50002	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449746150322825563 02/09/24-22:12:35.179665	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49746	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449745150322825563 02/09/24-22:12:32.551798	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49745	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449961150322033132 02/09/24-22:15:32.891267	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49961	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449744150322825563 02/09/24-22:12:29.925790	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49744	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449943150322033132 02/09/24-22:15:20.633041	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49943	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449964150322033132 02/09/24-22:15:34.761863	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49964	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449942150322033132 02/09/24-22:15:20.021837	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49942	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449941150322033132 02/09/24-22:15:19.382937	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49941	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449962150322033132 02/09/24-22:15:33.515754	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49962	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449743150322825563 02/09/24-22:12:27.291613	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49743	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449963150322033132 02/09/24-22:15:34.143365	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49963	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249918150322033132 02/09/24-22:15:03.547852	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49918	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749780150322033132 02/09/24-22:13:30.942366	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49780	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749782150322033132 02/09/24-22:13:32.747790	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49782	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749814150322033132 02/09/24-22:13:56.249160	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49814	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449749150322033132 02/09/24-22:12:42.815553	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49749	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249841150322033132 02/09/24-22:14:13.877367	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49841	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249883150322033132 02/09/24-22:14:41.542343	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49883	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749784150322033132 02/09/24-22:13:34.465629	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49784	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749786150322033132 02/09/24-22:13:36.121436	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49786	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249843150322033132 02/09/24-22:14:15.148862	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49843	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249914150322033132 02/09/24-22:15:00.983048	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49914	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249881150322033132 02/09/24-22:14:40.314960	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49881	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249885150322033132 02/09/24-22:14:42.791880	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49885	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449749150322825563 02/09/24-22:12:43.084374	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49749	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749816150322033132 02/09/24-22:13:57.570038	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49816	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249916150322033132 02/09/24-22:15:02.262168	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49916	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449747150322033132 02/09/24-22:12:37.528314	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49747	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449938150322033132 02/09/24-22:15:17.503285	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49938	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749818150322033132 02/09/24-22:13:58.862057	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49818	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249849150322033132 02/09/24-22:14:20.019412	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49849	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449741150322033132 02/09/24-22:12:21.723366	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49741	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249839150322033132 02/09/24-22:14:12.583408	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49839	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449751150322033132 02/09/24-22:12:48.093276	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49751	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249847150322033132 02/09/24-22:14:18.737628	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49847	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249879150322033132 02/09/24-22:14:39.091451	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49879	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249889150322033132 02/09/24-22:14:45.336742	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49889	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449745150322033132 02/09/24-22:12:32.268832	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49745	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249845150322033132 02/09/24-22:14:16.422475	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49845	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249877150322033132 02/09/24-22:14:37.818662	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49877	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249835150322033132 02/09/24-22:14:10.031003	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49835	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249887150322033132 02/09/24-22:14:44.071826	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49887	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449755150322033132 02/09/24-22:12:55.215555	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49755	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749777150322033132 02/09/24-22:13:28.103145	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49777	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749779150322033132 02/09/24-22:13:30.026542	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49779	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749788150322033132 02/09/24-22:13:37.760935	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49788	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449743150322033132 02/09/24-22:12:27.169293	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49743	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249833150322033132 02/09/24-22:14:08.741511	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49833	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249912150322033132 02/09/24-22:14:59.737123	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49912	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249882150322825564 02/09/24-22:14:41.203960	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49882	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6450002150322033132 02/09/24-22:15:58.795615	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50002	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249910150322033132 02/09/24-22:14:58.465380	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49910	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749812150322033132 02/09/24-22:13:54.917672	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49812	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749823150322033132 02/09/24-22:14:02.177519	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49823	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6450000150322033132 02/09/24-22:15:57.320689	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50000	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249837150322033132 02/09/24-22:14:11.305759	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49837	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749810150322033132 02/09/24-22:13:53.589871	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49810	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749821150322033132 02/09/24-22:14:00.857452	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49821	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249909150322033132 02/09/24-22:14:57.850069	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49909	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249890150322033132 02/09/24-22:14:45.937717	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49890	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449991150322033132 02/09/24-22:15:51.676224	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49991	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249852150322033132 02/09/24-22:14:21.907671	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49852	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249873150322033132 02/09/24-22:14:35.296123	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49873	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249894150322033132 02/09/24-22:14:48.438381	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49894	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249831150322033132 02/09/24-22:14:07.503641	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49831	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449759150322033132 02/09/24-22:13:03.240333	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49759	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249903150322033132 02/09/24-22:14:54.077716	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49903	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449739150322825563 02/09/24-22:12:16.725609	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49739	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249850150322033132 02/09/24-22:14:20.629868	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49850	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249854150322033132 02/09/24-22:14:23.180801	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49854	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249871150322033132 02/09/24-22:14:34.036022	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49871	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249875150322033132 02/09/24-22:14:36.552674	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49875	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249896150322033132 02/09/24-22:14:49.685144	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49896	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249892150322033132 02/09/24-22:14:47.203586	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49892	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449757150322033132 02/09/24-22:12:59.416646	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49757	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249905150322033132 02/09/24-22:14:55.322144	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49905	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249907150322033132 02/09/24-22:14:56.571056	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49907	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449936150322033132 02/09/24-22:15:16.252129	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49936	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449978150322033132 02/09/24-22:15:43.571979	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49978	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449957150322033132 02/09/24-22:15:30.372830	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49957	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449959150322033132 02/09/24-22:15:31.648522	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49959	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449976150322033132 02/09/24-22:15:42.317143	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49976	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449997150322033132 02/09/24-22:15:55.455002	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49997	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449752150322825563 02/09/24-22:12:50.865934	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49752	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449955150322033132 02/09/24-22:15:29.110273	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49955	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449934150322033132 02/09/24-22:15:15.001004	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49934	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449999150322033132 02/09/24-22:15:56.715373	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49999	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449750150322825563 02/09/24-22:12:45.736211	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49750	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449758150322825563 02/09/24-22:13:01.637665	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49758	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449970150322033132 02/09/24-22:15:38.533574	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49970	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449951150322033132 02/09/24-22:15:26.618074	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49951	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449972150322033132 02/09/24-22:15:39.808799	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49972	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449993150322033132 02/09/24-22:15:52.948649	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49993	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449756150322825563 02/09/24-22:12:57.648959	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49756	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449932150322033132 02/09/24-22:15:13.742161	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49932	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449733150322825563 02/09/24-22:12:14.095345	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49733	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449974150322033132 02/09/24-22:15:41.051269	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49974	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449953150322033132 02/09/24-22:15:27.873612	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49953	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449930150322033132 02/09/24-22:15:12.504473	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49930	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449995150322033132 02/09/24-22:15:54.196845	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49995	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249828150322033132 02/09/24-22:14:05.542781	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49828	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249829150322033132 02/09/24-22:14:06.173453	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49829	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749799150322033132 02/09/24-22:13:45.993074	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49799	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249898150322033132 02/09/24-22:14:50.957730	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49898	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249897150322033132 02/09/24-22:14:50.310241	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49897	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249899150322033132 02/09/24-22:14:51.563600	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49899	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449928150322825564 02/09/24-22:15:11.496905	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49928	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249827150322033132 02/09/24-22:14:04.899767	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49827	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249890150322825564 02/09/24-22:14:46.223642	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49890	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749790150322033132 02/09/24-22:13:39.333098	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49790	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749791150322033132 02/09/24-22:13:40.095025	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49791	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749826150322033132 02/09/24-22:14:04.142855	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49826	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749792150322033132 02/09/24-22:13:40.849504	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49792	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749825150322033132 02/09/24-22:14:03.478957	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49825	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749795150322033132 02/09/24-22:13:43.087531	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49795	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749793150322033132 02/09/24-22:13:41.597332	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49793	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749797150322033132 02/09/24-22:13:44.561738	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49797	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749794150322033132 02/09/24-22:13:42.349844	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49794	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749798150322033132 02/09/24-22:13:45.260898	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49798	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449929150322033132 02/09/24-22:15:11.863674	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49929	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449927150322033132 02/09/24-22:15:10.603445	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49927	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449928150322033132 02/09/24-22:15:11.219074	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49928	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749796150322033132 02/09/24-22:13:43.829629	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49796	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449989150322033132 02/09/24-22:15:50.423352	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49989	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449925150322033132 02/09/24-22:15:09.324630	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49925	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449926150322033132 02/09/24-22:15:09.952476	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49926	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449987150322033132 02/09/24-22:15:49.186603	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49987	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449986150322033132 02/09/24-22:15:48.553357	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49986	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449922150322033132 02/09/24-22:15:07.462426	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49922	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449923150322033132 02/09/24-22:15:08.075146	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49923	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449924150322033132 02/09/24-22:15:08.692607	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49924	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449988150322033132 02/09/24-22:15:49.846541	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49988	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449981150322033132 02/09/24-22:15:45.441894	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49981	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449982150322033132 02/09/24-22:15:46.071527	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49982	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449983150322033132 02/09/24-22:15:46.689639	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49983	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449985150322033132 02/09/24-22:15:47.933359	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49985	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449921150322033132 02/09/24-22:15:06.819261	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49921	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449920150322033132 02/09/24-22:15:06.225141	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49920	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449984150322033132 02/09/24-22:15:47.307585	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49984	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249919150322033132 02/09/24-22:15:05.716968	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49919	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249880150322033132 02/09/24-22:14:39.695363	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49880	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6450000150322825564 02/09/24-22:15:57.603132	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	50000	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749815150322033132 02/09/24-22:13:56.908864	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49815	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449980150322033132 02/09/24-22:15:44.827318	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49980	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249913150322033132 02/09/24-22:15:00.371843	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49913	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749781150322033132 02/09/24-22:13:31.855494	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49781	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449748150322825563 02/09/24-22:12:40.455149	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49748	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249884150322033132 02/09/24-22:14:42.168705	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49884	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449748150322033132 02/09/24-22:12:40.173961	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49748	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249882150322033132 02/09/24-22:14:40.923481	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49882	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249886150322033132 02/09/24-22:14:43.412742	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49886	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249842150322033132 02/09/24-22:14:14.495826	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49842	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249915150322033132 02/09/24-22:15:01.617601	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49915	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749783150322033132 02/09/24-22:13:33.615235	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49783	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749787150322033132 02/09/24-22:13:36.945033	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49787	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749817150322033132 02/09/24-22:13:58.203064	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49817	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249887150322825564 02/09/24-22:14:44.343068	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49887	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449746150322033132 02/09/24-22:12:34.897710	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49746	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449939150322033132 02/09/24-22:15:18.119215	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49939	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749819150322033132 02/09/24-22:13:59.538281	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49819	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249840150322033132 02/09/24-22:14:13.228596	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49840	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249917150322033132 02/09/24-22:15:02.875445	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49917	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749785150322033132 02/09/24-22:13:35.285168	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49785	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449752150322033132 02/09/24-22:12:50.596394	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49752	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449742150322033132 02/09/24-22:12:24.370492	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49742	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249838150322033132 02/09/24-22:14:11.941691	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49838	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249836150322033132 02/09/24-22:14:10.674906	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49836	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249846150322033132 02/09/24-22:14:18.391742	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49846	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449756150322033132 02/09/24-22:12:57.376284	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49756	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749778150322033132 02/09/24-22:13:29.104971	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49778	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249834150322033132 02/09/24-22:14:09.383518	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49834	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249888150322033132 02/09/24-22:14:44.697077	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49888	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449744150322033132 02/09/24-22:12:29.652728	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49744	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249876150322033132 02/09/24-22:14:37.189327	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49876	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249878150322033132 02/09/24-22:14:38.450202	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49878	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449754150322033132 02/09/24-22:12:52.954248	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49754	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249844150322033132 02/09/24-22:14:15.780205	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49844	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749789150322033132 02/09/24-22:13:38.630867	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49789	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749813150322033132 02/09/24-22:13:55.583165	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49813	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749822150322033132 02/09/24-22:14:01.516334	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49822	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.122.10749824150322033132 02/09/24-22:14:02.822123	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49824	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.98.23249911150322033132 02/09/24-22:14:59.102209	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49911	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.122.10749820150322033132 02/09/24-22:14:00.179713	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49820	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449750150322033132 02/09/24-22:12:45.447291	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49750	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.122.10749811150322033132 02/09/24-22:13:54.245406	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49811	15032	192.168.2.4	3.6.122.107
192.168.2.43.6.115.6449740150322033132 02/09/24-22:12:19.091730	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49740	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249848150322033132 02/09/24-22:14:19.371205	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49848	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6450001150322033132 02/09/24-22:15:57.949710	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50001	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249908150322033132 02/09/24-22:14:57.205033	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49908	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249891150322033132 02/09/24-22:14:46.567107	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49891	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249870150322033132 02/09/24-22:14:33.403010	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49870	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249902150322033132 02/09/24-22:14:53.460527	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49902	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449739150322033132 02/09/24-22:12:16.446955	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49739	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249830150322033132 02/09/24-22:14:06.815335	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49830	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249872150322033132 02/09/24-22:14:34.669327	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49872	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249874150322033132 02/09/24-22:14:35.927653	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49874	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249895150322033132 02/09/24-22:14:49.055994	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49895	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449759150322825563 02/09/24-22:13:03.509386	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49759	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449990150322033132 02/09/24-22:15:51.052510	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49990	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249832150322033132 02/09/24-22:14:08.093237	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49832	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249893150322033132 02/09/24-22:14:47.823297	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49893	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249853150322033132 02/09/24-22:14:22.549864	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49853	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249904150322033132 02/09/24-22:14:54.697300	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49904	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449758150322033132 02/09/24-22:13:01.380495	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49758	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.98.23249851150322033132 02/09/24-22:14:21.279507	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49851	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.98.23249906150322033132 02/09/24-22:14:55.948386	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49906	15032	192.168.2.4	3.6.98.232
192.168.2.43.6.115.6449730150322825563 02/09/24-22:12:07.800248	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49730	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449979150322033132 02/09/24-22:15:44.200180	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49979	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449935150322033132 02/09/24-22:15:15.634356	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49935	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449937150322033132 02/09/24-22:15:16.891844	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49937	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449751150322825563 02/09/24-22:12:48.367907	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49751	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449998150322033132 02/09/24-22:15:56.071461	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49998	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449954150322033132 02/09/24-22:15:28.524284	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49954	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449958150322033132 02/09/24-22:15:30.994596	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49958	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449933150322033132 02/09/24-22:15:14.380389	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49933	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449977150322033132 02/09/24-22:15:42.958157	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49977	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449956150322033132 02/09/24-22:15:29.739104	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49956	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449992150322033132 02/09/24-22:15:52.295563	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49992	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449971150322033132 02/09/24-22:15:39.170811	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49971	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449757150322825563 02/09/24-22:12:59.682819	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49757	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449994150322033132 02/09/24-22:15:53.567362	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49994	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449950150322033132 02/09/24-22:15:25.995375	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49950	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449996150322033132 02/09/24-22:15:54.830912	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49996	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449975150322033132 02/09/24-22:15:41.710369	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49975	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449931150322033132 02/09/24-22:15:13.110090	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49931	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449755150322825563 02/09/24-22:12:55.494635	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49755	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449973150322033132 02/09/24-22:15:40.435805	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49973	15032	192.168.2.4	3.6.115.64
192.168.2.43.6.115.6449952150322033132 02/09/24-22:15:27.235300	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49952	15032	192.168.2.4	3.6.115.64

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 9, 2024 22:12:04.552138090 CET	49729	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:04.859405994 CET	15032	49729	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:04.859570026 CET	49729	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:05.055068016 CET	49729	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:05.168710947 CET	15032	49729	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:05.169023991 CET	49729	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:05.362313986 CET	15032	49729	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:05.479988098 CET	15032	49729	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:07.179941893 CET	49730	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:07.489237070 CET	15032	49730	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:07.489609957 CET	49730	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:07.540323973 CET	49730	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:07.800143957 CET	15032	49730	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:07.800247908 CET	49730	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:07.850083113 CET	15032	49730	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:08.109682083 CET	15032	49730	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:09.804040909 CET	49731	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:10.110657930 CET	15032	49731	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:10.111043930 CET	49731	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:10.418729067 CET	15032	49731	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:10.418910980 CET	49731	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:11.454015017 CET	49731	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:11.760411978 CET	15032	49731	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:13.460074902 CET	49733	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:13.776437998 CET	15032	49733	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:13.776772022 CET	49733	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:13.804049015 CET	49733	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:14.095254898 CET	15032	49733	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:14.095345020 CET	49733	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:14.120193005 CET	15032	49733	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:14.411202908 CET	15032	49733	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:16.100919008 CET	49739	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:16.412307978 CET	15032	49739	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:16.412518024 CET	49739	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:16.446954966 CET	49739	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:16.725492954 CET	15032	49739	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:16.725609064 CET	49739	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:16.758023024 CET	15032	49739	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:17.036720037 CET	15032	49739	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:18.742067099 CET	49740	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:19.060697079 CET	15032	49740	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:19.060898066 CET	49740	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:19.091730118 CET	49740	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:19.380563021 CET	15032	49740	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:19.380738020 CET	49740	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:19.410058022 CET	15032	49740	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:19.698851109 CET	15032	49740	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:21.382608891 CET	49741	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:21.693670034 CET	15032	49741	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:21.693952084 CET	49741	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:21.723366022 CET	49741	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:22.006335974 CET	15032	49741	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:22.006424904 CET	49741	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:22.034169912 CET	15032	49741	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:22.316989899 CET	15032	49741	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:24.023500919 CET	49742	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:24.335757971 CET	15032	49742	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:24.336133003 CET	49742	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:24.370491982 CET	49742	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:24.650119066 CET	15032	49742	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:24.650295019 CET	49742	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:24.682490110 CET	15032	49742	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:24.962260008 CET	15032	49742	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:26.663949966 CET	49743	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:26.976862907 CET	15032	49743	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:26.977026939 CET	49743	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:27.169292927 CET	49743	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:27.291553020 CET	15032	49743	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:27.291613102 CET	49743	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:27.482177019 CET	15032	49743	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:27.604465008 CET	15032	49743	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:29.304107904 CET	49744	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:29.614160061 CET	15032	49744	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:29.614285946 CET	49744	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:29.652728081 CET	49744	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:29.925702095 CET	15032	49744	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:29.925790071 CET	49744	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:29.962681055 CET	15032	49744	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:30.235774994 CET	15032	49744	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:31.928843975 CET	49745	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:32.239326954 CET	15032	49745	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:32.239552975 CET	49745	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:32.268831968 CET	49745	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:32.551495075 CET	15032	49745	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:32.551798105 CET	49745	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:32.579041958 CET	15032	49745	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:32.862109900 CET	15032	49745	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:34.554579020 CET	49746	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:34.865695953 CET	15032	49746	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:34.866004944 CET	49746	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:34.897710085 CET	49746	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:35.179455042 CET	15032	49746	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:35.179665089 CET	49746	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:35.209033012 CET	15032	49746	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:35.490612984 CET	15032	49746	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:37.194829941 CET	49747	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:37.501024961 CET	15032	49747	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:37.501113892 CET	49747	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:37.528314114 CET	49747	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:37.808875084 CET	15032	49747	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:37.809108019 CET	49747	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:37.834508896 CET	15032	49747	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:38.115678072 CET	15032	49747	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:39.819632053 CET	49748	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:40.136378050 CET	15032	49748	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:40.136615038 CET	49748	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:40.173960924 CET	49748	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:40.455055952 CET	15032	49748	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:40.455148935 CET	49748	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:40.490883112 CET	15032	49748	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:40.772113085 CET	15032	49748	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:42.461052895 CET	49749	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:42.771760941 CET	15032	49749	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:42.771873951 CET	49749	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:42.815552950 CET	49749	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:43.084162951 CET	15032	49749	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:43.084373951 CET	49749	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:43.126147985 CET	15032	49749	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:43.396392107 CET	15032	49749	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:45.101504087 CET	49750	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:45.418137074 CET	15032	49750	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:45.418253899 CET	49750	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:45.447290897 CET	49750	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:45.736085892 CET	15032	49750	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:45.736211061 CET	49750	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:45.763609886 CET	15032	49750	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:46.052640915 CET	15032	49750	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:47.742619038 CET	49751	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:48.053349972 CET	15032	49751	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:48.053834915 CET	49751	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:48.093276024 CET	49751	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:48.367556095 CET	15032	49751	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:48.367907047 CET	49751	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:48.403254032 CET	15032	49751	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:48.678005934 CET	15032	49751	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:50.242158890 CET	49752	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:50.553168058 CET	15032	49752	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:50.553421974 CET	49752	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:50.596394062 CET	49752	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:50.865822077 CET	15032	49752	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:50.865933895 CET	49752	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:50.907167912 CET	15032	49752	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:51.177239895 CET	15032	49752	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:52.617336988 CET	49754	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:52.926537991 CET	15032	49754	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:52.926666021 CET	49754	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:52.954247952 CET	49754	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:53.237802029 CET	15032	49754	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:53.237862110 CET	49754	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:53.263161898 CET	15032	49754	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:53.546868086 CET	15032	49754	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:54.866483927 CET	49755	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:55.180285931 CET	15032	49755	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:55.180432081 CET	49755	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:55.215554953 CET	49755	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:55.494554043 CET	15032	49755	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:55.494610071 CET	15032	49755	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:55.494635105 CET	49755	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:55.494663954 CET	49755	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:55.529223919 CET	15032	49755	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:55.808345079 CET	15032	49755	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:55.808387995 CET	15032	49755	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:57.023220062 CET	49756	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:57.335829020 CET	15032	49756	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:57.336090088 CET	49756	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:57.376283884 CET	49756	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:57.648832083 CET	15032	49756	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:57.648880959 CET	15032	49756	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:57.648958921 CET	49756	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:57.649046898 CET	49756	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:57.688694000 CET	15032	49756	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:57.961616993 CET	15032	49756	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:57.961673975 CET	15032	49756	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:59.070921898 CET	49757	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:59.376496077 CET	15032	49757	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:59.376641035 CET	49757	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:59.416646004 CET	49757	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:59.682605028 CET	15032	49757	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:59.682676077 CET	15032	49757	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:59.682818890 CET	49757	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:59.682818890 CET	49757	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:12:59.722179890 CET	15032	49757	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:59.988500118 CET	15032	49757	3.6.115.64	192.168.2.4
Feb 9, 2024 22:12:59.988535881 CET	15032	49757	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:01.007746935 CET	49758	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:13:01.320867062 CET	15032	49758	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:01.324075937 CET	49758	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:13:01.380495071 CET	49758	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:13:01.637464046 CET	15032	49758	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:01.637523890 CET	15032	49758	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:01.637665033 CET	49758	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:13:01.693732023 CET	15032	49758	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:01.950691938 CET	15032	49758	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:02.882908106 CET	49759	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:13:03.196166992 CET	15032	49759	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:03.196595907 CET	49759	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:13:03.240333080 CET	49759	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:13:03.509222984 CET	15032	49759	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:03.509280920 CET	15032	49759	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:03.509386063 CET	49759	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:13:03.509386063 CET	49759	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:13:03.553226948 CET	15032	49759	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:03.821654081 CET	15032	49759	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:03.821680069 CET	15032	49759	3.6.115.64	192.168.2.4
Feb 9, 2024 22:13:04.786144018 CET	49760	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:05.101064920 CET	15032	49760	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:05.101161957 CET	49760	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:05.137012959 CET	49760	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:05.416119099 CET	15032	49760	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:05.416182041 CET	15032	49760	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:05.416254997 CET	49760	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:05.416254997 CET	49760	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:05.451777935 CET	15032	49760	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:05.730699062 CET	15032	49760	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:05.730725050 CET	15032	49760	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:06.507975101 CET	49761	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:06.818407059 CET	15032	49761	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:06.818542957 CET	49761	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:06.852703094 CET	49761	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:07.128724098 CET	15032	49761	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:07.128756046 CET	15032	49761	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:07.128844976 CET	49761	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:07.162508011 CET	15032	49761	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:07.438807964 CET	15032	49761	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:08.148838043 CET	49762	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:08.465702057 CET	15032	49762	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:08.466203928 CET	49762	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:08.501857996 CET	49762	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:08.683403015 CET	49762	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:08.782460928 CET	15032	49762	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:08.782490969 CET	15032	49762	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:08.782625914 CET	49762	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:08.817548037 CET	15032	49762	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:08.999346972 CET	15032	49762	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:09.098464966 CET	15032	49762	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:09.726790905 CET	49763	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:10.041466951 CET	15032	49763	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:10.041591883 CET	49763	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:10.067277908 CET	49763	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:10.233328104 CET	49763	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:10.361970901 CET	15032	49763	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:10.362032890 CET	15032	49763	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:10.362241030 CET	49763	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:10.381732941 CET	15032	49763	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:10.548072100 CET	15032	49763	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:10.548113108 CET	15032	49763	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:10.676820040 CET	15032	49763	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:11.242691994 CET	49764	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:11.559274912 CET	15032	49764	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:11.560131073 CET	49764	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:11.591356993 CET	49764	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:11.765337944 CET	49764	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:11.877051115 CET	15032	49764	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:11.877099037 CET	15032	49764	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:11.877254009 CET	49764	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:11.907689095 CET	15032	49764	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:12.082935095 CET	15032	49764	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:12.193589926 CET	15032	49764	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:12.695338964 CET	49765	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:13.012797117 CET	15032	49765	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:13.012895107 CET	49765	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:13.044689894 CET	49765	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:13.199624062 CET	49765	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:13.329941034 CET	15032	49765	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:13.329988003 CET	15032	49765	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:13.330029011 CET	49765	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:13.330054045 CET	49765	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:13.361054897 CET	15032	49765	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:13.515964985 CET	15032	49765	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:13.646333933 CET	15032	49765	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:13.646374941 CET	15032	49765	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:14.101006031 CET	49766	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:14.417478085 CET	15032	49766	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:14.417691946 CET	49766	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:14.485281944 CET	49766	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:14.738450050 CET	15032	49766	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:14.738508940 CET	15032	49766	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:14.738884926 CET	49766	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:14.801603079 CET	15032	49766	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:15.055520058 CET	15032	49766	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:16.447047949 CET	49767	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:16.757335901 CET	15032	49767	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:16.757543087 CET	49767	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:16.789089918 CET	49767	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:17.000623941 CET	49767	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:17.068000078 CET	15032	49767	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:17.068048954 CET	15032	49767	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:17.068239927 CET	49767	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:17.068240881 CET	49767	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:17.099122047 CET	15032	49767	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:17.310667992 CET	15032	49767	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:17.310707092 CET	15032	49767	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:17.378261089 CET	15032	49767	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:17.378293991 CET	15032	49767	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:17.741956949 CET	49768	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:18.053500891 CET	15032	49768	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:18.053792953 CET	49768	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:18.107306004 CET	49768	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:18.306885004 CET	49768	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:18.364177942 CET	15032	49768	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:18.364217997 CET	15032	49768	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:18.364352942 CET	49768	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:18.364352942 CET	49768	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:18.417661905 CET	15032	49768	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:18.617588997 CET	15032	49768	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:18.674592972 CET	15032	49768	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:18.674649954 CET	15032	49768	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:18.993165016 CET	49769	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:19.301539898 CET	15032	49769	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:19.301765919 CET	49769	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:19.345665932 CET	49769	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:19.603306055 CET	49769	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:19.610492945 CET	15032	49769	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:19.610579014 CET	15032	49769	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:19.610626936 CET	49769	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:19.610662937 CET	49769	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:19.654149055 CET	15032	49769	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:19.912072897 CET	15032	49769	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:19.918723106 CET	15032	49769	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:19.918761015 CET	15032	49769	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:20.195807934 CET	49770	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:20.511559963 CET	15032	49770	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:20.511683941 CET	49770	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:20.551353931 CET	49770	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:20.768646002 CET	49770	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:20.827524900 CET	15032	49770	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:20.827558994 CET	15032	49770	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:20.827613115 CET	49770	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:20.827636003 CET	49770	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:20.866730928 CET	15032	49770	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:21.084103107 CET	15032	49770	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:21.142864943 CET	15032	49770	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:21.142999887 CET	15032	49770	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:21.387438059 CET	49771	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:21.694581032 CET	15032	49771	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:21.694820881 CET	49771	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:21.738301039 CET	49771	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:22.001777887 CET	15032	49771	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:22.001838923 CET	15032	49771	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:22.001930952 CET	49771	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:22.001981020 CET	49771	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:22.044899940 CET	15032	49771	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:22.308793068 CET	15032	49771	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:22.308902025 CET	15032	49771	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:22.510741949 CET	49772	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:22.824151039 CET	15032	49772	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:22.824383974 CET	49772	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:22.866204977 CET	49772	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:23.098913908 CET	49772	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:23.137747049 CET	15032	49772	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:23.137811899 CET	15032	49772	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:23.137986898 CET	49772	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:23.137986898 CET	49772	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:23.179521084 CET	15032	49772	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:23.412245035 CET	15032	49772	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:23.451020002 CET	15032	49772	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:23.451078892 CET	15032	49772	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:23.618088961 CET	49773	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:23.934855938 CET	15032	49773	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:23.936642885 CET	49773	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:23.970662117 CET	49773	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:24.197917938 CET	49773	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:24.253572941 CET	15032	49773	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:24.253689051 CET	15032	49773	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:24.253868103 CET	49773	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:24.287483931 CET	15032	49773	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:24.514779091 CET	15032	49773	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:24.570370913 CET	15032	49773	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:24.695970058 CET	49774	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:25.008059025 CET	15032	49774	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:25.008284092 CET	49774	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:25.047044992 CET	49774	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:25.226156950 CET	49774	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:25.320379019 CET	15032	49774	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:25.320441961 CET	15032	49774	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:25.320770979 CET	49774	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:25.358958006 CET	15032	49774	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:25.538093090 CET	15032	49774	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:25.538177013 CET	15032	49774	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:25.632643938 CET	15032	49774	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:25.742481947 CET	49775	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:26.058868885 CET	15032	49775	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:26.062024117 CET	49775	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:26.101248980 CET	49775	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:26.340740919 CET	49775	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:26.379014015 CET	15032	49775	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:26.379030943 CET	15032	49775	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:26.379103899 CET	49775	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:26.379209995 CET	49775	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:26.417825937 CET	15032	49775	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:26.657361984 CET	15032	49775	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:26.657382965 CET	15032	49775	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:26.695467949 CET	15032	49775	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:26.695487976 CET	15032	49775	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:26.773246050 CET	49776	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:27.078572035 CET	15032	49776	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:27.078716040 CET	49776	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:27.118464947 CET	49776	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:27.302536011 CET	49776	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:27.389415979 CET	15032	49776	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:27.389434099 CET	15032	49776	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:27.389476061 CET	49776	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:27.389492035 CET	49776	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:27.423805952 CET	15032	49776	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:27.608019114 CET	15032	49776	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:27.694636106 CET	15032	49776	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:27.694658995 CET	15032	49776	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:27.757925987 CET	49777	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:28.072729111 CET	15032	49777	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:28.072877884 CET	49777	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:28.103144884 CET	49777	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:28.269678116 CET	49777	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:28.387877941 CET	15032	49777	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:28.387937069 CET	15032	49777	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:28.387989044 CET	49777	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:28.388053894 CET	49777	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:28.417785883 CET	15032	49777	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:28.584609032 CET	15032	49777	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:28.702545881 CET	15032	49777	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:28.702594995 CET	15032	49777	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:28.730743885 CET	49778	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:29.045413017 CET	15032	49778	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:29.048129082 CET	49778	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:29.104970932 CET	49778	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:29.281212091 CET	49778	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:29.363028049 CET	15032	49778	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:29.363085985 CET	15032	49778	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:29.363231897 CET	49778	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:29.419542074 CET	15032	49778	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:29.596074104 CET	15032	49778	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:29.596117973 CET	15032	49778	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:29.677802086 CET	15032	49778	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:29.679555893 CET	49779	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:29.990995884 CET	15032	49779	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:29.993046999 CET	49779	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:30.026541948 CET	49779	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:30.202567101 CET	49779	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:30.305632114 CET	15032	49779	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:30.305690050 CET	15032	49779	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:30.305725098 CET	49779	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:30.305792093 CET	49779	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:30.338032961 CET	15032	49779	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:30.514306068 CET	15032	49779	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:30.599904060 CET	49779	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:30.601682901 CET	49780	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:30.617599964 CET	15032	49779	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:30.617659092 CET	15032	49779	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:30.911700964 CET	15032	49780	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:30.911777973 CET	49780	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:30.942365885 CET	49780	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:31.121104002 CET	49780	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:31.222160101 CET	15032	49780	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:31.222194910 CET	15032	49780	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:31.222316027 CET	49780	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:31.252579927 CET	15032	49780	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:31.431633949 CET	15032	49780	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:31.431694031 CET	15032	49780	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:31.506037951 CET	49780	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:31.507683992 CET	49781	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:31.532378912 CET	15032	49780	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:31.819504976 CET	15032	49781	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:31.822020054 CET	49781	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:31.855494022 CET	49781	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:32.016284943 CET	49781	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:32.134799004 CET	15032	49781	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:32.134865046 CET	15032	49781	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:32.135008097 CET	49781	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:32.167273998 CET	15032	49781	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:32.328043938 CET	15032	49781	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:32.396759033 CET	49781	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:32.398679972 CET	49782	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:32.449024916 CET	15032	49781	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:32.714904070 CET	15032	49782	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:32.715023994 CET	49782	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:32.747790098 CET	49782	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:32.907927036 CET	49782	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:33.031488895 CET	15032	49782	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:33.031550884 CET	15032	49782	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:33.031656027 CET	49782	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:33.064043045 CET	15032	49782	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:33.227682114 CET	15032	49782	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:33.227735043 CET	15032	49782	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:33.271656990 CET	49782	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:33.273382902 CET	49783	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:33.347963095 CET	15032	49782	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:33.583740950 CET	15032	49783	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:33.583894968 CET	49783	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:33.615235090 CET	49783	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:33.784926891 CET	49783	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:33.893987894 CET	15032	49783	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:33.894011974 CET	15032	49783	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:33.894104004 CET	49783	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:33.925441027 CET	15032	49783	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:34.095184088 CET	15032	49783	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:34.115638018 CET	49783	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:34.118577003 CET	49784	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:34.207600117 CET	15032	49783	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:34.425512075 CET	15032	49784	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:34.427962065 CET	49784	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:34.465629101 CET	49784	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:34.668936968 CET	49784	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:34.734925985 CET	15032	49784	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:34.734981060 CET	15032	49784	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:34.735071898 CET	49784	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:34.772608995 CET	15032	49784	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:34.943548918 CET	49784	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:34.944911003 CET	49785	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:34.976670027 CET	15032	49784	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:34.976728916 CET	15032	49784	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:35.041922092 CET	15032	49784	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:35.256390095 CET	15032	49785	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:35.257194996 CET	49785	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:35.285167933 CET	49785	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:35.457855940 CET	49785	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:35.569046021 CET	15032	49785	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:35.569114923 CET	15032	49785	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:35.569210052 CET	49785	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:35.569210052 CET	49785	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:35.596762896 CET	15032	49785	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:35.769486904 CET	15032	49785	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:35.771769047 CET	49785	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:35.773264885 CET	49786	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:35.881359100 CET	15032	49785	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:35.881419897 CET	15032	49785	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:36.082084894 CET	15032	49786	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:36.082333088 CET	49786	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:36.121436119 CET	49786	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:36.306581020 CET	49786	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:36.391586065 CET	15032	49786	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:36.391648054 CET	15032	49786	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:36.391963005 CET	49786	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:36.430159092 CET	15032	49786	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:36.584399939 CET	49786	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:36.588351965 CET	49787	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:36.615566015 CET	15032	49786	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:36.701811075 CET	15032	49786	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:36.904150009 CET	15032	49787	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:36.908541918 CET	49787	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:36.945033073 CET	49787	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:37.178394079 CET	49787	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:37.223488092 CET	15032	49787	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:37.223516941 CET	15032	49787	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:37.223640919 CET	49787	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:37.260454893 CET	15032	49787	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:37.396792889 CET	49787	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:37.398885965 CET	49788	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:37.492750883 CET	15032	49787	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:37.537869930 CET	15032	49787	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:37.711796045 CET	15032	49788	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:37.712048054 CET	49788	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:37.760935068 CET	49788	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:38.025134087 CET	15032	49788	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:38.025161982 CET	15032	49788	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:38.025271893 CET	49788	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:38.025271893 CET	49788	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:38.073693037 CET	15032	49788	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:38.193764925 CET	49788	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:38.196533918 CET	49789	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:38.338085890 CET	15032	49788	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:38.338201046 CET	15032	49788	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:38.509517908 CET	15032	49789	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:38.509644985 CET	49789	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:38.630867004 CET	49789	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:38.822787046 CET	15032	49789	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:38.822854996 CET	15032	49789	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:38.823199987 CET	49789	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:38.943526030 CET	15032	49789	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:38.974932909 CET	49789	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:38.977567911 CET	49790	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:39.136198997 CET	15032	49789	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:39.291589022 CET	15032	49790	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:39.291970015 CET	49790	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:39.333097935 CET	49790	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:39.580216885 CET	49790	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:39.606076002 CET	15032	49790	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:39.606139898 CET	15032	49790	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:39.606264114 CET	49790	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:39.606264114 CET	49790	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:39.646780968 CET	15032	49790	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:39.756138086 CET	49790	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:39.757476091 CET	49791	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:39.893822908 CET	15032	49790	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:39.894351006 CET	15032	49790	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:39.919878006 CET	15032	49790	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:39.919986010 CET	15032	49790	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:40.063051939 CET	15032	49791	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:40.063359976 CET	49791	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:40.095025063 CET	49791	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:40.255356073 CET	49791	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:40.369355917 CET	15032	49791	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:40.369405985 CET	15032	49791	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:40.369448900 CET	49791	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:40.369493008 CET	49791	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:40.400680065 CET	15032	49791	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:40.506107092 CET	49791	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:40.507917881 CET	49792	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:40.561312914 CET	15032	49791	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:40.675225973 CET	15032	49791	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:40.675339937 CET	15032	49791	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:40.818279982 CET	15032	49792	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:40.818382025 CET	49792	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:40.849503994 CET	49792	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:41.013562918 CET	49792	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:41.129177094 CET	15032	49792	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:41.129209995 CET	15032	49792	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:41.129300117 CET	49792	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:41.160206079 CET	15032	49792	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:41.256091118 CET	49792	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:41.257838011 CET	49793	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:41.324297905 CET	15032	49792	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:41.439903975 CET	15032	49792	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:41.569612980 CET	15032	49793	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:41.569824934 CET	49793	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:41.597332001 CET	49793	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:41.808747053 CET	49793	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:41.881746054 CET	15032	49793	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:41.881807089 CET	15032	49793	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:41.882065058 CET	49793	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:41.912853956 CET	15032	49793	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:42.006226063 CET	49793	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:42.007878065 CET	49794	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:42.125709057 CET	15032	49793	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:42.197693110 CET	15032	49793	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:42.319319963 CET	15032	49794	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:42.319470882 CET	49794	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:42.349843979 CET	49794	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:42.541852951 CET	49794	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:42.631282091 CET	15032	49794	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:42.631305933 CET	15032	49794	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:42.631346941 CET	49794	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:42.631364107 CET	49794	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:42.660844088 CET	15032	49794	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:42.740478039 CET	49794	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:42.742379904 CET	49795	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:42.852746010 CET	15032	49794	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:42.942363024 CET	15032	49794	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:42.942423105 CET	15032	49794	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:43.051615953 CET	15032	49795	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:43.051825047 CET	49795	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:43.087531090 CET	49795	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:43.268558979 CET	49795	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:43.361695051 CET	15032	49795	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:43.361759901 CET	15032	49795	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:43.362091064 CET	49795	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:43.396903038 CET	15032	49795	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:43.474786043 CET	49795	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:43.476058960 CET	49796	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:43.578114033 CET	15032	49795	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:43.578154087 CET	15032	49795	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:43.671638966 CET	15032	49795	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:43.792239904 CET	15032	49796	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:43.797029972 CET	49796	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:43.829628944 CET	49796	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:43.997525930 CET	49796	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:44.115803957 CET	15032	49796	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.115917921 CET	15032	49796	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.116051912 CET	49796	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:44.146080971 CET	15032	49796	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.209175110 CET	49796	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:44.211287022 CET	49797	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:44.314002037 CET	15032	49796	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.314063072 CET	15032	49796	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.432590008 CET	15032	49796	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.517019987 CET	15032	49797	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.517134905 CET	49797	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:44.561738014 CET	49797	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:44.766176939 CET	49797	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:44.823057890 CET	15032	49797	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.823121071 CET	15032	49797	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.823298931 CET	49797	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:44.867217064 CET	15032	49797	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:44.912518024 CET	49797	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:44.913945913 CET	49798	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:45.071932077 CET	15032	49797	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:45.128875971 CET	15032	49797	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:45.224165916 CET	15032	49798	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:45.228146076 CET	49798	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:45.260898113 CET	49798	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:45.415612936 CET	49798	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:45.541734934 CET	15032	49798	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:45.541795969 CET	15032	49798	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:45.541884899 CET	49798	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:45.571183920 CET	15032	49798	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:45.630996943 CET	49798	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:45.633358002 CET	49799	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:45.725747108 CET	15032	49798	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:45.851964951 CET	15032	49798	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:45.949666023 CET	15032	49799	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:45.949771881 CET	49799	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:45.993073940 CET	49799	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.182019949 CET	49799	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.267923117 CET	15032	49799	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:46.267949104 CET	15032	49799	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:46.268008947 CET	49799	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.268009901 CET	49799	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.309361935 CET	15032	49799	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:46.349754095 CET	49799	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.351609945 CET	49800	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.498437881 CET	15032	49799	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:46.584858894 CET	15032	49799	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:46.584897041 CET	15032	49799	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:46.661288023 CET	15032	49800	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:46.661478043 CET	49800	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.695780993 CET	49800	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.870507002 CET	49800	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.971455097 CET	15032	49800	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:46.971518040 CET	15032	49800	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:46.971560955 CET	49800	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:46.971653938 CET	49800	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:47.005458117 CET	15032	49800	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:47.053105116 CET	49800	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:47.055115938 CET	49801	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:47.180649996 CET	15032	49800	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:47.281335115 CET	15032	49800	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:47.281443119 CET	15032	49800	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:47.360717058 CET	15032	49801	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:47.364207983 CET	49801	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:47.389939070 CET	49801	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:47.568706036 CET	49801	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:47.670084000 CET	15032	49801	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:47.670090914 CET	15032	49801	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:47.670273066 CET	49801	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:47.695625067 CET	15032	49801	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:47.740612030 CET	49801	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:47.741765022 CET	49802	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:47.874195099 CET	15032	49801	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:47.975622892 CET	15032	49801	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:48.057914019 CET	15032	49802	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:48.062097073 CET	49802	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:48.096772909 CET	49802	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:48.277867079 CET	49802	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:48.378607035 CET	15032	49802	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:48.378720999 CET	15032	49802	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:48.378809929 CET	49802	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:48.412803888 CET	15032	49802	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:48.443686962 CET	49802	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:48.445732117 CET	49803	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:48.597801924 CET	15032	49802	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:48.694927931 CET	15032	49802	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:48.757077932 CET	15032	49803	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:48.757169008 CET	49803	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:48.810484886 CET	49803	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.005861044 CET	49803	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.070009947 CET	15032	49803	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.070074081 CET	15032	49803	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.070363998 CET	49803	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.122041941 CET	15032	49803	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.130990982 CET	49803	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.135927916 CET	49804	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.317488909 CET	15032	49803	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.317596912 CET	15032	49803	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.381800890 CET	15032	49803	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.447603941 CET	15032	49804	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.447820902 CET	49804	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.479204893 CET	49804	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.665590048 CET	49804	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.760401964 CET	15032	49804	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.760463953 CET	15032	49804	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.760605097 CET	49804	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.760605097 CET	49804	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.791013956 CET	15032	49804	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.818651915 CET	49804	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.820018053 CET	49805	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:49.977396965 CET	15032	49804	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:49.977454901 CET	15032	49804	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.072218895 CET	15032	49804	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.072278023 CET	15032	49804	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.133657932 CET	15032	49805	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.133872986 CET	49805	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:50.160330057 CET	49805	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:50.321928024 CET	49805	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:50.447946072 CET	15032	49805	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.448059082 CET	15032	49805	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.448363066 CET	49805	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:50.474268913 CET	15032	49805	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.506051064 CET	49805	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:50.507939100 CET	49806	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:50.635823011 CET	15032	49805	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.762075901 CET	15032	49805	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.824765921 CET	15032	49806	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:50.824853897 CET	49806	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:50.872880936 CET	49806	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.029494047 CET	49806	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.141866922 CET	15032	49806	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.141944885 CET	15032	49806	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.141968966 CET	49806	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.141997099 CET	49806	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.189690113 CET	15032	49806	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.193536043 CET	49806	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.195231915 CET	49807	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.346307993 CET	15032	49806	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.458539009 CET	15032	49806	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.458643913 CET	15032	49806	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.508337975 CET	15032	49807	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.510077000 CET	49807	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.542118073 CET	49807	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.756392956 CET	49807	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.824126005 CET	15032	49807	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.824189901 CET	15032	49807	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.824191093 CET	49807	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.824225903 CET	49807	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.855376005 CET	15032	49807	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:51.881073952 CET	49807	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:51.882778883 CET	49808	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:52.069858074 CET	15032	49807	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.137326956 CET	15032	49807	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.137670994 CET	15032	49807	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.194024086 CET	15032	49808	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.198045969 CET	49808	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:52.221826077 CET	49808	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:52.377160072 CET	49808	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:52.509656906 CET	15032	49808	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.509694099 CET	15032	49808	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.509939909 CET	49808	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:52.532253981 CET	15032	49808	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.552911043 CET	49808	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:52.555001020 CET	49809	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:52.688113928 CET	15032	49808	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.688182116 CET	15032	49808	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.820179939 CET	15032	49808	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.865964890 CET	15032	49809	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:52.866719007 CET	49809	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:52.900561094 CET	49809	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.081011057 CET	49809	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.178071022 CET	15032	49809	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:53.178102970 CET	15032	49809	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:53.178203106 CET	49809	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.211477041 CET	15032	49809	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:53.224807978 CET	49809	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.226562023 CET	49810	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.392144918 CET	15032	49809	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:53.489445925 CET	15032	49809	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:53.538625002 CET	15032	49810	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:53.538824081 CET	49810	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.589870930 CET	49810	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.789470911 CET	49810	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.850514889 CET	15032	49810	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:53.850575924 CET	15032	49810	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:53.850625992 CET	49810	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.850625992 CET	49810	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.896712065 CET	49810	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.898762941 CET	49811	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:53.901521921 CET	15032	49810	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.101197004 CET	15032	49810	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.162262917 CET	15032	49810	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.162322044 CET	15032	49810	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.210025072 CET	15032	49811	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.210652113 CET	49811	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:54.245405912 CET	49811	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:54.397337914 CET	49811	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:54.522160053 CET	15032	49811	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.522221088 CET	15032	49811	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.522428036 CET	49811	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:54.556843042 CET	15032	49811	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.568716049 CET	49811	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:54.570745945 CET	49812	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:54.708750963 CET	15032	49811	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.833776951 CET	15032	49811	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.883932114 CET	15032	49812	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:54.884200096 CET	49812	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:54.917671919 CET	49812	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.128468990 CET	49812	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.198781013 CET	15032	49812	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.198847055 CET	15032	49812	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.199009895 CET	49812	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.230739117 CET	15032	49812	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.240509033 CET	49812	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.242500067 CET	49813	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.441773891 CET	15032	49812	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.441836119 CET	15032	49812	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.512079000 CET	15032	49812	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.552700043 CET	15032	49813	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.552824974 CET	49813	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.583164930 CET	49813	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.812350988 CET	49813	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.863578081 CET	15032	49813	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.863645077 CET	15032	49813	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.863727093 CET	49813	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.863727093 CET	49813	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.893404961 CET	15032	49813	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:55.896737099 CET	49813	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:55.899482965 CET	49814	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:56.122613907 CET	15032	49813	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.122689009 CET	15032	49813	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.173815966 CET	15032	49813	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.173948050 CET	15032	49813	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.209479094 CET	15032	49814	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.209626913 CET	49814	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:56.249160051 CET	49814	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:56.403040886 CET	49814	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:56.520003080 CET	15032	49814	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.520071030 CET	15032	49814	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.520229101 CET	49814	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:56.520229101 CET	49814	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:56.553355932 CET	49814	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:56.555799007 CET	49815	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:56.560868025 CET	15032	49814	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.713040113 CET	15032	49814	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.830370903 CET	15032	49814	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.830426931 CET	15032	49814	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.868262053 CET	15032	49815	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:56.868413925 CET	49815	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:56.908864021 CET	49815	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.097171068 CET	49815	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.181025028 CET	15032	49815	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:57.181094885 CET	15032	49815	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:57.181119919 CET	49815	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.181154013 CET	49815	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.212294102 CET	49815	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.213992119 CET	49816	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.220947981 CET	15032	49815	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:57.409337997 CET	15032	49815	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:57.493160963 CET	15032	49815	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:57.493215084 CET	15032	49815	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:57.524311066 CET	15032	49816	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:57.528600931 CET	49816	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.570038080 CET	49816	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.839046001 CET	15032	49816	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:57.839102030 CET	15032	49816	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:57.839145899 CET	49816	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.839176893 CET	49816	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.866416931 CET	49816	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.867769957 CET	49817	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:57.880161047 CET	15032	49816	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.150541067 CET	15032	49816	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.150604963 CET	15032	49816	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.173197031 CET	15032	49817	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.173757076 CET	49817	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:58.203063965 CET	49817	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:58.419543982 CET	49817	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:58.479433060 CET	15032	49817	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.479494095 CET	15032	49817	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.479587078 CET	49817	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:58.506134033 CET	49817	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:58.508501053 CET	15032	49817	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.516117096 CET	49818	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:58.725163937 CET	15032	49817	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.785018921 CET	15032	49817	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.827649117 CET	15032	49818	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:58.827735901 CET	49818	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:58.862056971 CET	49818	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.052009106 CET	49818	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.139662027 CET	15032	49818	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:59.139725924 CET	15032	49818	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:59.139794111 CET	49818	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.173507929 CET	15032	49818	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:59.177947044 CET	49818	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.180480957 CET	49819	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.363775015 CET	15032	49818	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:59.451796055 CET	15032	49818	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:59.497462988 CET	15032	49819	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:59.497566938 CET	49819	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.538280964 CET	49819	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.731476068 CET	49819	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.812419891 CET	15032	49819	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:59.812484026 CET	15032	49819	3.6.122.107	192.168.2.4
Feb 9, 2024 22:13:59.812508106 CET	49819	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.812525988 CET	49819	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.834156990 CET	49819	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.836225033 CET	49820	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:13:59.852828026 CET	15032	49819	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.046185017 CET	15032	49819	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.046243906 CET	15032	49819	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.127156973 CET	15032	49819	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.127218008 CET	15032	49819	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.148967028 CET	15032	49820	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.152386904 CET	49820	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:00.179713011 CET	49820	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:00.357280970 CET	49820	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:00.466320992 CET	15032	49820	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.466389894 CET	15032	49820	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.466617107 CET	49820	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:00.490556955 CET	49820	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:00.491609097 CET	15032	49820	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.492386103 CET	49821	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:00.669301987 CET	15032	49820	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.778651953 CET	15032	49820	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.810187101 CET	15032	49821	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:00.810290098 CET	49821	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:00.857451916 CET	49821	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.045011044 CET	49821	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.128448009 CET	15032	49821	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.128768921 CET	15032	49821	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.128784895 CET	49821	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.128851891 CET	49821	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.162342072 CET	49821	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.168498993 CET	49822	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.175298929 CET	15032	49821	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.363512993 CET	15032	49821	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.447107077 CET	15032	49821	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.447169065 CET	15032	49821	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.485434055 CET	15032	49822	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.485687971 CET	49822	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.516334057 CET	49822	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.691752911 CET	49822	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.802849054 CET	15032	49822	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.802911997 CET	15032	49822	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.802922010 CET	49822	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.802970886 CET	49822	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.832988977 CET	15032	49822	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:01.834253073 CET	49822	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:01.836524963 CET	49823	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.008290052 CET	15032	49822	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.119445086 CET	15032	49822	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.119489908 CET	15032	49822	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.146759033 CET	15032	49823	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.148052931 CET	49823	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.177519083 CET	49823	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.340519905 CET	49823	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.458205938 CET	15032	49823	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.458256960 CET	15032	49823	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.458293915 CET	49823	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.458329916 CET	49823	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.474766970 CET	49823	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.476577044 CET	49824	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.487571955 CET	15032	49823	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.650935888 CET	15032	49823	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.650990009 CET	15032	49823	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.768260002 CET	15032	49823	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.768307924 CET	15032	49823	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.788212061 CET	15032	49824	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:02.788314104 CET	49824	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.822123051 CET	49824	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:02.997246027 CET	49824	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.101604939 CET	15032	49824	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.101667881 CET	15032	49824	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.101816893 CET	49824	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.101816893 CET	49824	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.131150007 CET	49824	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.133184910 CET	49825	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.133614063 CET	15032	49824	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.308996916 CET	15032	49824	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.413697958 CET	15032	49824	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.413755894 CET	15032	49824	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.445641041 CET	15032	49825	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.450001001 CET	49825	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.478956938 CET	49825	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.663294077 CET	49825	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.762902975 CET	15032	49825	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.762970924 CET	15032	49825	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.763017893 CET	49825	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.763017893 CET	49825	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.787290096 CET	49825	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.789170980 CET	49826	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:03.791397095 CET	15032	49825	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:03.975810051 CET	15032	49825	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:04.075644016 CET	15032	49825	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:04.075753927 CET	15032	49825	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:04.100509882 CET	15032	49826	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:04.100697994 CET	49826	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:04.142854929 CET	49826	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:04.347610950 CET	49826	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:04.412039995 CET	15032	49826	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:04.412103891 CET	15032	49826	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:04.412194967 CET	49826	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:04.427865028 CET	49826	15032	192.168.2.4	3.6.122.107
Feb 9, 2024 22:14:04.454138041 CET	15032	49826	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:04.553952932 CET	49827	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:04.658770084 CET	15032	49826	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:04.723459005 CET	15032	49826	3.6.122.107	192.168.2.4
Feb 9, 2024 22:14:04.859541893 CET	15032	49827	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:04.859627962 CET	49827	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:04.899766922 CET	49827	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.103260994 CET	49827	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.165380001 CET	15032	49827	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.165401936 CET	15032	49827	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.165477037 CET	49827	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.165477037 CET	49827	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.177998066 CET	49827	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.179435015 CET	49828	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.205447912 CET	15032	49827	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.408879042 CET	15032	49827	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.408961058 CET	15032	49827	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.470858097 CET	15032	49827	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.470915079 CET	15032	49827	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.494128942 CET	15032	49828	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.495774031 CET	49828	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.542781115 CET	49828	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.724421978 CET	49828	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.810379982 CET	15032	49828	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.810451984 CET	49828	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.810461998 CET	15032	49828	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:05.810513020 CET	49828	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.834430933 CET	49828	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.836174965 CET	49829	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:05.857459068 CET	15032	49828	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.038867950 CET	15032	49828	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.124739885 CET	15032	49828	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.124773026 CET	15032	49828	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.142882109 CET	15032	49829	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.143115997 CET	49829	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:06.173453093 CET	49829	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:06.368849993 CET	49829	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:06.450952053 CET	15032	49829	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.451020002 CET	15032	49829	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.451317072 CET	49829	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:06.475053072 CET	49829	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:06.476830006 CET	49830	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:06.480465889 CET	15032	49829	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.676059008 CET	15032	49829	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.759146929 CET	15032	49829	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.784411907 CET	15032	49830	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:06.784519911 CET	49830	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:06.815335035 CET	49830	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.013417959 CET	49830	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.092186928 CET	15032	49830	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.092247963 CET	15032	49830	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.092278957 CET	49830	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.092317104 CET	49830	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.115569115 CET	49830	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.116806030 CET	49831	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.122832060 CET	15032	49830	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.321116924 CET	15032	49830	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.399753094 CET	15032	49830	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.399811983 CET	15032	49830	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.425096035 CET	15032	49831	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.425184965 CET	49831	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.503640890 CET	49831	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.668112993 CET	49831	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.733587980 CET	15032	49831	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.733669996 CET	15032	49831	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.733675003 CET	49831	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.733719110 CET	49831	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.756155014 CET	49831	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.757658005 CET	49832	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:07.811748981 CET	15032	49831	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.976325989 CET	15032	49831	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:07.976442099 CET	15032	49831	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.041553020 CET	15032	49831	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.041614056 CET	15032	49831	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.067965031 CET	15032	49832	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.068069935 CET	49832	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:08.093236923 CET	49832	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:08.273127079 CET	49832	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:08.378643990 CET	15032	49832	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.378746033 CET	15032	49832	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.378834009 CET	49832	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:08.396786928 CET	49832	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:08.398484945 CET	49833	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:08.403543949 CET	15032	49832	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.583719969 CET	15032	49832	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.688865900 CET	15032	49832	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.708883047 CET	15032	49833	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:08.709091902 CET	49833	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:08.741511106 CET	49833	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:08.936963081 CET	49833	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.019711018 CET	15032	49833	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.019860029 CET	15032	49833	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.020009995 CET	49833	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.020009995 CET	49833	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.037375927 CET	49833	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.039036036 CET	49834	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.051781893 CET	15032	49833	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.247405052 CET	15032	49833	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.330682993 CET	15032	49833	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.330741882 CET	15032	49833	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.355304003 CET	15032	49834	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.356009960 CET	49834	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.383517981 CET	49834	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.564131021 CET	49834	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.672324896 CET	15032	49834	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.672354937 CET	15032	49834	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.672547102 CET	49834	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.672635078 CET	49834	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.693591118 CET	49834	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.696263075 CET	49835	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:09.699680090 CET	15032	49834	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.880215883 CET	15032	49834	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.880260944 CET	15032	49834	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.988817930 CET	15032	49834	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:09.988836050 CET	15032	49834	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.002094030 CET	15032	49835	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.002301931 CET	49835	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.031002998 CET	49835	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.226779938 CET	49835	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.307943106 CET	15032	49835	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.308029890 CET	15032	49835	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.308042049 CET	49835	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.308084011 CET	49835	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.323559046 CET	49835	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.325459957 CET	49836	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.336167097 CET	15032	49835	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.532043934 CET	15032	49835	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.613281965 CET	15032	49835	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.613367081 CET	15032	49835	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.635989904 CET	15032	49836	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.636269093 CET	49836	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.674906015 CET	49836	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.946863890 CET	15032	49836	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.946993113 CET	15032	49836	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:10.947062969 CET	49836	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.947062969 CET	49836	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.960139990 CET	49836	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.962157011 CET	49837	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:10.985166073 CET	15032	49836	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.257813931 CET	15032	49836	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.257874012 CET	15032	49836	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.272269964 CET	15032	49837	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.277028084 CET	49837	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:11.305758953 CET	49837	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:11.467689991 CET	49837	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:11.587624073 CET	15032	49837	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.587685108 CET	15032	49837	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.587944984 CET	49837	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:11.599878073 CET	49837	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:11.601069927 CET	49838	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:11.616393089 CET	15032	49837	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.778256893 CET	15032	49837	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.898257971 CET	15032	49837	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.915618896 CET	15032	49838	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:11.915728092 CET	49838	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:11.941690922 CET	49838	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.132935047 CET	49838	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.230990887 CET	15032	49838	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:12.231056929 CET	15032	49838	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:12.231152058 CET	49838	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.240540028 CET	49838	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.242546082 CET	49839	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.256320953 CET	15032	49838	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:12.447576046 CET	15032	49838	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:12.545603991 CET	15032	49838	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:12.551992893 CET	15032	49839	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:12.552903891 CET	49839	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.583408117 CET	49839	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.828172922 CET	49839	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.862633944 CET	15032	49839	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:12.862698078 CET	15032	49839	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:12.862721920 CET	49839	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.862756014 CET	49839	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.881133080 CET	49839	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.883517981 CET	49840	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:12.892779112 CET	15032	49839	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.137449026 CET	15032	49839	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.137474060 CET	15032	49839	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.172112942 CET	15032	49839	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.172175884 CET	15032	49839	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.194327116 CET	15032	49840	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.194432974 CET	49840	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:13.228595972 CET	49840	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:13.478996992 CET	49840	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:13.505292892 CET	15032	49840	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.505326033 CET	15032	49840	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.505547047 CET	49840	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:13.505547047 CET	49840	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:13.521701097 CET	49840	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:13.525192022 CET	49841	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:13.540004969 CET	15032	49840	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.789329052 CET	15032	49840	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.815825939 CET	15032	49840	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.815869093 CET	15032	49840	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.832166910 CET	15032	49841	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:13.832268953 CET	49841	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:13.877367020 CET	49841	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.140033960 CET	15032	49841	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:14.140094042 CET	15032	49841	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:14.140471935 CET	49841	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.146841049 CET	49841	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.148864985 CET	49842	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.184489965 CET	15032	49841	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:14.447880983 CET	15032	49841	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:14.455919981 CET	15032	49842	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:14.458199024 CET	49842	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.495826006 CET	49842	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.765572071 CET	15032	49842	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:14.765634060 CET	15032	49842	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:14.765687943 CET	49842	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.765721083 CET	49842	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.771778107 CET	49842	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.774060011 CET	49843	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:14.803507090 CET	15032	49842	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:15.072758913 CET	15032	49842	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:15.072805882 CET	15032	49842	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:15.084013939 CET	15032	49843	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:15.084151030 CET	49843	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:15.148861885 CET	49843	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:15.394577980 CET	15032	49843	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:15.394638062 CET	15032	49843	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:15.394845009 CET	49843	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:15.412440062 CET	49843	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:15.415409088 CET	49844	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:15.458893061 CET	15032	49843	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:15.704956055 CET	15032	49843	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:15.729654074 CET	15032	49844	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:15.729765892 CET	49844	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:15.780205011 CET	49844	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:16.044008017 CET	15032	49844	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:16.044033051 CET	15032	49844	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:16.044116020 CET	49844	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:16.044116974 CET	49844	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:16.078166962 CET	49844	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:16.080759048 CET	49845	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:16.094342947 CET	15032	49844	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:16.358807087 CET	15032	49844	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:16.358830929 CET	15032	49844	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:16.387212038 CET	15032	49845	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:16.389955997 CET	49845	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:16.422475100 CET	49845	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:16.696171999 CET	15032	49845	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:16.696202040 CET	15032	49845	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:16.696283102 CET	49845	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:16.727912903 CET	15032	49845	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:16.744498014 CET	49845	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:16.745837927 CET	49846	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:17.002242088 CET	15032	49845	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:17.052373886 CET	15032	49846	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:17.052932024 CET	49846	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:17.360141993 CET	15032	49846	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:17.360198021 CET	15032	49846	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:17.360394955 CET	49846	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:18.391741991 CET	49846	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:18.396615028 CET	49846	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:18.397852898 CET	49847	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:18.698209047 CET	15032	49846	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:18.704773903 CET	15032	49847	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:18.704976082 CET	49847	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:18.737627983 CET	49847	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:18.983117104 CET	49847	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.012351990 CET	15032	49847	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.012382984 CET	15032	49847	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.012404919 CET	49847	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.012420893 CET	49847	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.021704912 CET	49847	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.023713112 CET	49848	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.045377016 CET	15032	49847	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.290138006 CET	15032	49847	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.319240093 CET	15032	49847	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.319356918 CET	15032	49847	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.333570004 CET	15032	49848	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.336623907 CET	49848	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.371205091 CET	49848	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.595952988 CET	49848	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.648310900 CET	15032	49848	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.648335934 CET	15032	49848	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.648535967 CET	49848	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.662518024 CET	49848	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.664469957 CET	49849	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:19.681746960 CET	15032	49848	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.906043053 CET	15032	49848	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.906092882 CET	15032	49848	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.958512068 CET	15032	49848	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.971585035 CET	15032	49849	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:19.971762896 CET	49849	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.019412041 CET	49849	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.236742020 CET	49849	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.279349089 CET	15032	49849	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:20.279407024 CET	15032	49849	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:20.279515982 CET	49849	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.287353039 CET	49849	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.289124966 CET	49850	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.326898098 CET	15032	49849	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:20.544183969 CET	15032	49849	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:20.586529016 CET	15032	49849	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:20.599474907 CET	15032	49850	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:20.602029085 CET	49850	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.629868031 CET	49850	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.849356890 CET	49850	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.912642002 CET	15032	49850	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:20.912770987 CET	15032	49850	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:20.912811995 CET	49850	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.912851095 CET	49850	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.927977085 CET	49850	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.930453062 CET	49851	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:20.940182924 CET	15032	49850	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.159977913 CET	15032	49850	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.223083973 CET	15032	49850	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.223139048 CET	15032	49850	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.244031906 CET	15032	49851	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.244148970 CET	49851	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:21.279506922 CET	49851	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:21.507484913 CET	49851	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:21.558043957 CET	15032	49851	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.558109045 CET	15032	49851	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.558273077 CET	49851	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:21.558273077 CET	49851	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:21.568661928 CET	49851	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:21.570586920 CET	49852	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:21.593120098 CET	15032	49851	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.823304892 CET	15032	49851	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.823796988 CET	15032	49851	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.872347116 CET	15032	49851	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.872406960 CET	15032	49851	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.880640030 CET	15032	49852	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:21.880733967 CET	49852	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:21.907670975 CET	49852	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.116213083 CET	49852	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.191315889 CET	15032	49852	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:22.191379070 CET	15032	49852	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:22.191425085 CET	49852	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.191489935 CET	49852	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.209186077 CET	49852	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.211021900 CET	49853	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.217637062 CET	15032	49852	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:22.426716089 CET	15032	49852	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:22.501697063 CET	15032	49852	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:22.501808882 CET	15032	49852	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:22.517869949 CET	15032	49853	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:22.517996073 CET	49853	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.549864054 CET	49853	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.736419916 CET	49853	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.824976921 CET	15032	49853	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:22.825006008 CET	15032	49853	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:22.825082064 CET	49853	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.825257063 CET	49853	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.834155083 CET	49853	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.835983038 CET	49854	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:22.856519938 CET	15032	49853	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.043241024 CET	15032	49853	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.131819963 CET	15032	49853	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.131875038 CET	15032	49853	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.147141933 CET	15032	49854	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.147315979 CET	49854	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:23.180800915 CET	49854	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:23.350344896 CET	49854	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:23.459005117 CET	15032	49854	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.459117889 CET	15032	49854	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.459165096 CET	49854	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:23.459222078 CET	49854	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:23.474762917 CET	49854	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:23.476655006 CET	49855	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:23.492053986 CET	15032	49854	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.661987066 CET	15032	49854	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.770518064 CET	15032	49854	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.770544052 CET	15032	49854	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.791183949 CET	15032	49855	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:23.792361975 CET	49855	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:23.834326982 CET	49855	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.052149057 CET	49855	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.107141018 CET	15032	49855	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.107165098 CET	15032	49855	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.107300997 CET	49855	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.115443945 CET	49855	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.116723061 CET	49856	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.149182081 CET	15032	49855	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.366470098 CET	15032	49855	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.421647072 CET	15032	49855	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.430757046 CET	15032	49856	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.430867910 CET	49856	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.484580994 CET	49856	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.668154001 CET	49856	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.745311975 CET	15032	49856	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.745342016 CET	15032	49856	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.745398045 CET	49856	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.745425940 CET	49856	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.755996943 CET	49856	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.758012056 CET	49857	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:24.799149990 CET	15032	49856	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.982501030 CET	15032	49856	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:24.982552052 CET	15032	49856	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.059566021 CET	15032	49856	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.059592009 CET	15032	49856	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.068079948 CET	15032	49857	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.068159103 CET	49857	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.099971056 CET	49857	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.299716949 CET	49857	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.378736973 CET	15032	49857	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.378774881 CET	15032	49857	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.378882885 CET	49857	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.381143093 CET	49857	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.382452965 CET	49858	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.410043001 CET	15032	49857	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.610270977 CET	15032	49857	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.610349894 CET	15032	49857	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.689220905 CET	15032	49857	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.689289093 CET	15032	49858	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.689440966 CET	49858	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.713700056 CET	49858	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.908263922 CET	49858	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.997227907 CET	15032	49858	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.997307062 CET	15032	49858	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:25.997339964 CET	49858	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:25.997384071 CET	49858	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.006079912 CET	49858	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.007293940 CET	49859	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.020693064 CET	15032	49858	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.215935946 CET	15032	49858	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.305170059 CET	15032	49858	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.305219889 CET	15032	49858	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.318202019 CET	15032	49859	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.318290949 CET	49859	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.346760988 CET	49859	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.562340021 CET	49859	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.629196882 CET	15032	49859	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.629256964 CET	15032	49859	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.629324913 CET	49859	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.629324913 CET	49859	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.646748066 CET	49859	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.649219036 CET	49860	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.657250881 CET	15032	49859	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.873080015 CET	15032	49859	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.939807892 CET	15032	49859	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.939862967 CET	15032	49859	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.960750103 CET	15032	49860	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:26.960830927 CET	49860	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:26.991579056 CET	49860	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.184484005 CET	49860	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.272838116 CET	15032	49860	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:27.272901058 CET	15032	49860	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:27.272922039 CET	49860	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.272944927 CET	49860	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.287271023 CET	49860	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.289274931 CET	49861	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.303169966 CET	15032	49860	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:27.496800900 CET	15032	49860	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:27.584533930 CET	15032	49860	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:27.584650040 CET	15032	49860	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:27.605809927 CET	15032	49861	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:27.609985113 CET	49861	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.636667013 CET	49861	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.808670998 CET	49861	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.926712990 CET	15032	49861	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:27.926767111 CET	15032	49861	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:27.926800013 CET	49861	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.926841974 CET	49861	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.943656921 CET	49861	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.945879936 CET	49862	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:27.953977108 CET	15032	49861	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.127090931 CET	15032	49861	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.243417025 CET	15032	49861	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.243472099 CET	15032	49861	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.262304068 CET	15032	49862	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.262417078 CET	49862	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:28.291043997 CET	49862	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:28.480705023 CET	49862	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:28.579209089 CET	15032	49862	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.579271078 CET	15032	49862	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.579372883 CET	49862	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:28.581938028 CET	49862	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:28.584248066 CET	49862	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:28.589648962 CET	49863	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:28.607198000 CET	15032	49862	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.797527075 CET	15032	49862	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.895710945 CET	15032	49862	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.898128986 CET	15032	49862	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.906944036 CET	15032	49863	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:28.907030106 CET	49863	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:28.963376045 CET	49863	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.153740883 CET	49863	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.224694014 CET	15032	49863	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:29.224740028 CET	15032	49863	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:29.224910975 CET	49863	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.240499020 CET	49863	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.242022038 CET	49864	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.280904055 CET	15032	49863	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:29.471379995 CET	15032	49863	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:29.471436977 CET	15032	49863	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:29.542296886 CET	15032	49863	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:29.548927069 CET	15032	49864	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:29.552097082 CET	49864	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.601536036 CET	49864	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.778884888 CET	49864	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.859518051 CET	15032	49864	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:29.859580040 CET	15032	49864	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:29.859608889 CET	49864	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.859633923 CET	49864	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.865354061 CET	49864	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.874324083 CET	49865	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:29.908654928 CET	15032	49864	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.086198092 CET	15032	49864	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.086266994 CET	15032	49864	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.166754007 CET	15032	49864	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.166810989 CET	15032	49864	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.184583902 CET	15032	49865	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.184675932 CET	49865	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:30.217236042 CET	49865	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:30.406519890 CET	49865	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:30.495131969 CET	15032	49865	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.495197058 CET	15032	49865	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.495354891 CET	49865	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:30.506078005 CET	49865	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:30.507916927 CET	49866	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:30.527570963 CET	15032	49865	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.716818094 CET	15032	49865	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.805840969 CET	15032	49865	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.822087049 CET	15032	49866	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:30.824068069 CET	49866	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:30.856657982 CET	49866	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.057624102 CET	49866	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.138533115 CET	15032	49866	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.138654947 CET	15032	49866	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.138690948 CET	49866	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.138758898 CET	49866	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.146625996 CET	49866	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.148418903 CET	49867	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.170622110 CET	15032	49866	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.372807980 CET	15032	49866	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.372867107 CET	15032	49866	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.452996969 CET	15032	49866	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.453059912 CET	15032	49866	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.463026047 CET	15032	49867	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.463270903 CET	49867	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.488317013 CET	49867	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.677181005 CET	49867	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.778306961 CET	15032	49867	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.778372049 CET	15032	49867	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.778623104 CET	49867	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.787357092 CET	49867	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.789187908 CET	49868	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:31.802867889 CET	15032	49867	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.991803885 CET	15032	49867	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:31.991853952 CET	15032	49867	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.093936920 CET	15032	49867	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.106667042 CET	15032	49868	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.106755972 CET	49868	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:32.135593891 CET	49868	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:32.330490112 CET	49868	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:32.420547962 CET	15032	49868	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.420579910 CET	15032	49868	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.420628071 CET	49868	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:32.420628071 CET	49868	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:32.427998066 CET	49868	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:32.429805040 CET	49869	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:32.448921919 CET	15032	49868	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.644145012 CET	15032	49868	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.644167900 CET	15032	49868	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.734540939 CET	15032	49868	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.734580040 CET	15032	49868	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.740984917 CET	15032	49869	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:32.741138935 CET	49869	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:32.772748947 CET	49869	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:32.970288992 CET	49869	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.052835941 CET	15032	49869	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.052859068 CET	15032	49869	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.052921057 CET	49869	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.052921057 CET	49869	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.068527937 CET	49869	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.069896936 CET	49870	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.083853960 CET	15032	49869	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.281832933 CET	15032	49869	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.364032030 CET	15032	49869	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.364078045 CET	15032	49869	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.376863003 CET	15032	49870	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.380366087 CET	49870	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.403009892 CET	49870	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.566566944 CET	49870	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.688043118 CET	15032	49870	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.688074112 CET	15032	49870	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.688132048 CET	49870	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.688132048 CET	49870	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.689193010 CET	49870	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.691251993 CET	49871	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:33.710138083 CET	15032	49870	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.873975039 CET	15032	49870	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.874002934 CET	15032	49870	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.995222092 CET	15032	49870	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:33.995270967 CET	15032	49870	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.007606983 CET	15032	49871	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.007821083 CET	49871	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.036021948 CET	49871	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.222485065 CET	49871	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.324764013 CET	15032	49871	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.324830055 CET	15032	49871	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.324975014 CET	49871	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.324975967 CET	49871	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.325676918 CET	49871	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.327780008 CET	49872	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.352734089 CET	15032	49871	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.539144993 CET	15032	49871	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.641777992 CET	15032	49871	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.641838074 CET	15032	49871	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.641863108 CET	15032	49872	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.641999006 CET	49872	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.669327021 CET	49872	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.847462893 CET	49872	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.956809998 CET	15032	49872	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.956844091 CET	15032	49872	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:34.956878901 CET	49872	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.956903934 CET	49872	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.957875967 CET	49872	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.959774971 CET	49873	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:34.983901978 CET	15032	49872	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.161916971 CET	15032	49872	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.270113945 CET	15032	49873	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.270258904 CET	49873	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:35.270796061 CET	15032	49872	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.270833015 CET	15032	49872	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.296123028 CET	49873	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:35.524293900 CET	49873	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:35.580966949 CET	15032	49873	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.580997944 CET	15032	49873	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.581065893 CET	49873	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:35.581103086 CET	49873	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:35.582328081 CET	49873	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:35.584177017 CET	49874	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:35.607311964 CET	15032	49873	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.834853888 CET	15032	49873	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.891474009 CET	15032	49873	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.891505957 CET	15032	49873	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.895498991 CET	15032	49874	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:35.895701885 CET	49874	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:35.927653074 CET	49874	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.185791969 CET	49874	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.207513094 CET	15032	49874	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:36.207568884 CET	15032	49874	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:36.207770109 CET	49874	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.207770109 CET	49874	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.208924055 CET	49874	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.210661888 CET	49875	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.239270926 CET	15032	49874	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:36.497639894 CET	15032	49874	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:36.519289970 CET	15032	49874	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:36.519351006 CET	15032	49874	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:36.525437117 CET	15032	49875	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:36.528093100 CET	49875	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.552674055 CET	49875	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.742712021 CET	49875	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.843440056 CET	15032	49875	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:36.843508959 CET	15032	49875	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:36.843611002 CET	49875	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.844763041 CET	49875	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.846906900 CET	49876	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:36.867602110 CET	15032	49875	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.057611942 CET	15032	49875	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.157588005 CET	15032	49876	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.157666922 CET	49876	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:37.158343077 CET	15032	49875	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.189327002 CET	49876	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:37.391031027 CET	49876	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:37.468822002 CET	15032	49876	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.468885899 CET	15032	49876	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.468965054 CET	49876	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:37.469675064 CET	49876	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:37.471877098 CET	49877	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:37.500721931 CET	15032	49876	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.701678038 CET	15032	49876	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.779441118 CET	15032	49876	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.781821012 CET	15032	49877	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:37.783967018 CET	49877	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:37.818661928 CET	49877	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.031614065 CET	49877	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.094312906 CET	15032	49877	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.094340086 CET	15032	49877	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.094402075 CET	49877	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.094403028 CET	49877	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.095252037 CET	49877	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.097312927 CET	49878	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.128648043 CET	15032	49877	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.341514111 CET	15032	49877	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.404428959 CET	15032	49877	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.404472113 CET	15032	49877	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.410525084 CET	15032	49878	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.410615921 CET	49878	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.450201988 CET	49878	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.616667032 CET	49878	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.724229097 CET	15032	49878	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.724293947 CET	15032	49878	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.724364042 CET	49878	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.725433111 CET	49878	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.725433111 CET	49878	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.727567911 CET	49879	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:38.763312101 CET	15032	49878	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:38.930176973 CET	15032	49878	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.038275957 CET	15032	49878	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.038851023 CET	15032	49878	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.041117907 CET	15032	49879	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.041202068 CET	49879	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.091450930 CET	49879	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.269494057 CET	49879	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.354587078 CET	15032	49879	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.354625940 CET	15032	49879	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.354700089 CET	49879	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.354701042 CET	49879	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.355886936 CET	49879	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.357805014 CET	49880	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.404664993 CET	15032	49879	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.582684994 CET	15032	49879	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.582911968 CET	15032	49879	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.664283991 CET	15032	49880	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.664361000 CET	49880	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.667671919 CET	15032	49879	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.667862892 CET	15032	49879	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.695363045 CET	49880	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.864341974 CET	49880	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.970263004 CET	15032	49880	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.970297098 CET	15032	49880	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:39.970392942 CET	49880	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.971429110 CET	49880	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:39.973196030 CET	49881	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:40.001137018 CET	15032	49880	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.170099020 CET	15032	49880	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.170130968 CET	15032	49880	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.276043892 CET	15032	49880	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.278412104 CET	15032	49881	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.278534889 CET	49881	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:40.314960003 CET	49881	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:40.496982098 CET	49881	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:40.584320068 CET	15032	49881	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.584353924 CET	15032	49881	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.584444046 CET	49881	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:40.585239887 CET	49881	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:40.586429119 CET	49882	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:40.620452881 CET	15032	49881	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.802598953 CET	15032	49881	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.802639961 CET	15032	49881	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.889800072 CET	15032	49881	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.893034935 CET	15032	49882	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:40.896925926 CET	49882	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:40.923480988 CET	49882	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.189167023 CET	49882	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.203864098 CET	15032	49882	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:41.203915119 CET	15032	49882	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:41.203959942 CET	49882	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.204013109 CET	49882	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.205293894 CET	49882	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.207482100 CET	49883	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.229963064 CET	15032	49882	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:41.495964050 CET	15032	49882	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:41.510572910 CET	15032	49882	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:41.510610104 CET	15032	49882	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:41.514441013 CET	15032	49883	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:41.514570951 CET	49883	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.542342901 CET	49883	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.722029924 CET	49883	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.822108984 CET	15032	49883	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:41.822170019 CET	15032	49883	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:41.822295904 CET	49883	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.823491096 CET	49883	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.825875998 CET	49884	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:41.849188089 CET	15032	49883	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.029376030 CET	15032	49883	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.129403114 CET	15032	49883	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.135781050 CET	15032	49884	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.135883093 CET	49884	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:42.168704987 CET	49884	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:42.352559090 CET	49884	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:42.446871042 CET	15032	49884	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.446938038 CET	15032	49884	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.447153091 CET	49884	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:42.448481083 CET	49884	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:42.451122046 CET	49885	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:42.478866100 CET	15032	49884	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.662595987 CET	15032	49884	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.757342100 CET	15032	49884	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.757904053 CET	15032	49885	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:42.758141041 CET	49885	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:42.791879892 CET	49885	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:42.953883886 CET	49885	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.065572023 CET	15032	49885	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.065639019 CET	15032	49885	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.065665960 CET	49885	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.065697908 CET	49885	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.066603899 CET	49885	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.068377018 CET	49886	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.098812103 CET	15032	49885	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.261091948 CET	15032	49885	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.372487068 CET	15032	49885	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.372505903 CET	15032	49885	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.386452913 CET	15032	49886	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.386652946 CET	49886	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.412741899 CET	49886	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.625616074 CET	49886	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.708436012 CET	15032	49886	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.708498001 CET	15032	49886	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.708596945 CET	49886	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.713936090 CET	49886	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.715584993 CET	49887	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:43.731091022 CET	15032	49886	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:43.943720102 CET	15032	49886	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.026746035 CET	15032	49886	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.029058933 CET	15032	49887	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.029242992 CET	49887	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.071825981 CET	49887	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.332798004 CET	49887	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.342972040 CET	15032	49887	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.343023062 CET	15032	49887	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.343067884 CET	49887	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.343127966 CET	49887	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.344885111 CET	49887	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.347996950 CET	49888	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.385220051 CET	15032	49887	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.645939112 CET	15032	49887	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.656085014 CET	15032	49887	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.656121969 CET	15032	49887	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.663491011 CET	15032	49888	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.663583994 CET	49888	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.697077036 CET	49888	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.932523012 CET	49888	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.979312897 CET	15032	49888	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.979355097 CET	15032	49888	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:44.979477882 CET	49888	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.980166912 CET	49888	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:44.981525898 CET	49889	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:45.012599945 CET	15032	49888	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.248203039 CET	15032	49888	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.288641930 CET	15032	49889	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.288853884 CET	49889	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:45.294945955 CET	15032	49888	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.336741924 CET	49889	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:45.574325085 CET	49889	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:45.596638918 CET	15032	49889	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.596721888 CET	15032	49889	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.596738100 CET	49889	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:45.596921921 CET	49889	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:45.598371983 CET	49889	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:45.600347042 CET	49890	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:45.643925905 CET	15032	49889	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.881697893 CET	15032	49889	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.904405117 CET	15032	49889	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.904464960 CET	15032	49889	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.911648035 CET	15032	49890	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:45.911777973 CET	49890	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:45.937716961 CET	49890	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.195868969 CET	49890	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.223571062 CET	15032	49890	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:46.223642111 CET	49890	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.223649979 CET	15032	49890	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:46.223696947 CET	49890	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.224257946 CET	49890	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.226502895 CET	49891	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.249126911 CET	15032	49890	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:46.507078886 CET	15032	49890	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:46.538146973 CET	15032	49890	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:46.538168907 CET	15032	49890	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:46.538182974 CET	15032	49891	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:46.538264036 CET	49891	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.567106962 CET	49891	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.761095047 CET	49891	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.848505974 CET	15032	49891	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:46.848530054 CET	15032	49891	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:46.848583937 CET	49891	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.850861073 CET	49891	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.855767965 CET	49892	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:46.876931906 CET	15032	49891	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.071203947 CET	15032	49891	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.158813000 CET	15032	49891	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.167404890 CET	15032	49892	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.168529987 CET	49892	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:47.203586102 CET	49892	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:47.479790926 CET	49892	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:47.480900049 CET	15032	49892	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.480967999 CET	15032	49892	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.481014967 CET	49892	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:47.481846094 CET	49892	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:47.483236074 CET	49893	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:47.515124083 CET	15032	49892	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.790330887 CET	15032	49893	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.790463924 CET	49893	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:47.791404009 CET	15032	49892	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.792347908 CET	15032	49892	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:47.823297024 CET	49893	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:47.999198914 CET	49893	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.097773075 CET	15032	49893	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.097829103 CET	15032	49893	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.097850084 CET	49893	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.097878933 CET	49893	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.098792076 CET	49893	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.100478888 CET	49894	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.130239010 CET	15032	49893	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.306293011 CET	15032	49893	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.405082941 CET	15032	49893	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.405139923 CET	15032	49893	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.405502081 CET	15032	49894	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.408665895 CET	49894	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.438380957 CET	49894	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.606241941 CET	49894	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.714324951 CET	15032	49894	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.714339018 CET	15032	49894	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.714416981 CET	49894	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.715409040 CET	49894	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.717678070 CET	49895	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:48.743453979 CET	15032	49894	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:48.911642075 CET	15032	49894	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.019546032 CET	15032	49894	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.028964996 CET	15032	49895	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.029236078 CET	49895	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.055994034 CET	49895	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.281557083 CET	49895	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.340965986 CET	15032	49895	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.341018915 CET	15032	49895	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.341075897 CET	49895	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.342256069 CET	49895	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.344439983 CET	49896	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.367789030 CET	15032	49895	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.592937946 CET	15032	49895	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.652647018 CET	15032	49895	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.654365063 CET	15032	49896	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.654512882 CET	49896	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.685143948 CET	49896	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.853672028 CET	49896	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.964776993 CET	15032	49896	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.964824915 CET	15032	49896	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:49.964941978 CET	49896	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.965780020 CET	49896	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.968127966 CET	49897	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:49.995089054 CET	15032	49896	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.163535118 CET	15032	49896	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.274662971 CET	15032	49896	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.282576084 CET	15032	49897	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.282788038 CET	49897	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:50.310240984 CET	49897	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:50.542458057 CET	49897	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:50.597582102 CET	15032	49897	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.597603083 CET	15032	49897	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.597789049 CET	49897	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:50.598963022 CET	49897	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:50.601119041 CET	49898	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:50.624792099 CET	15032	49897	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.857084990 CET	15032	49897	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.906630993 CET	15032	49898	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.907244921 CET	49898	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:50.912221909 CET	15032	49897	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:50.957730055 CET	49898	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.178582907 CET	49898	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.213124037 CET	15032	49898	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:51.213198900 CET	15032	49898	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:51.213253021 CET	49898	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.213253975 CET	49898	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.214456081 CET	49898	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.216188908 CET	49899	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.263278008 CET	15032	49898	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:51.484472036 CET	15032	49898	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:51.518840075 CET	15032	49898	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:51.518879890 CET	15032	49898	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:51.527270079 CET	15032	49899	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:51.528820038 CET	49899	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.563600063 CET	49899	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.758667946 CET	49899	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.839997053 CET	15032	49899	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:51.840060949 CET	15032	49899	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:51.840172052 CET	49899	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.841567993 CET	49899	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.843914032 CET	49900	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:51.874979973 CET	15032	49899	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.069839954 CET	15032	49899	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.151335955 CET	15032	49899	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.155927896 CET	15032	49900	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.156018019 CET	49900	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:52.186940908 CET	49900	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:52.402368069 CET	49900	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:52.468394995 CET	15032	49900	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.468458891 CET	15032	49900	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.468641043 CET	49900	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:52.469599009 CET	49900	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:52.477051973 CET	49901	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:52.498893023 CET	15032	49900	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.714471102 CET	15032	49900	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.780715942 CET	15032	49900	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.787192106 CET	15032	49901	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:52.788506985 CET	49901	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:52.818617105 CET	49901	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.025854111 CET	49901	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.099929094 CET	15032	49901	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.099996090 CET	15032	49901	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.100156069 CET	49901	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.100156069 CET	49901	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.100739002 CET	49901	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.102854013 CET	49902	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.128524065 CET	15032	49901	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.335897923 CET	15032	49901	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.336021900 CET	15032	49901	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.410011053 CET	15032	49901	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.410048008 CET	15032	49901	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.415811062 CET	15032	49902	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.415889978 CET	49902	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.460526943 CET	49902	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.661390066 CET	49902	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.729518890 CET	15032	49902	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.729579926 CET	15032	49902	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.729710102 CET	49902	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.729710102 CET	49902	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.730568886 CET	49902	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.732538939 CET	49903	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:53.773828983 CET	15032	49902	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:53.974764109 CET	15032	49902	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.039865971 CET	15032	49903	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.040019989 CET	49903	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.043570995 CET	15032	49902	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.043632030 CET	15032	49902	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.077716112 CET	49903	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.286765099 CET	49903	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.348717928 CET	15032	49903	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.348787069 CET	15032	49903	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.348901033 CET	49903	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.349668980 CET	49903	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.350159883 CET	49903	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.351653099 CET	49904	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.384757996 CET	15032	49903	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.593708038 CET	15032	49903	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.593780041 CET	15032	49903	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.655668974 CET	15032	49903	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.656599045 CET	15032	49903	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.666342974 CET	15032	49904	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.666440010 CET	49904	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.697299957 CET	49904	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.887882948 CET	49904	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.981478930 CET	15032	49904	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.981544971 CET	15032	49904	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:54.981884956 CET	49904	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.982788086 CET	49904	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:54.984085083 CET	49905	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:55.012177944 CET	15032	49904	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.202869892 CET	15032	49904	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.202986956 CET	15032	49904	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.294312000 CET	15032	49905	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.294496059 CET	49905	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:55.296499014 CET	15032	49904	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.322144032 CET	49905	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:55.527745962 CET	49905	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:55.605855942 CET	15032	49905	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.605947018 CET	15032	49905	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.606044054 CET	49905	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:55.606945038 CET	49905	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:55.608249903 CET	49906	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:55.632519960 CET	15032	49905	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.838583946 CET	15032	49905	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.838645935 CET	15032	49905	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.915148973 CET	15032	49906	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.916085005 CET	15032	49905	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:55.916258097 CET	49906	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:55.948385954 CET	49906	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.129435062 CET	49906	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.227124929 CET	15032	49906	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:56.227175951 CET	15032	49906	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:56.227211952 CET	49906	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.227235079 CET	49906	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.228557110 CET	49906	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.230462074 CET	49907	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.255948067 CET	15032	49906	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:56.435033083 CET	15032	49906	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:56.533082962 CET	15032	49906	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:56.533119917 CET	15032	49906	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:56.541301012 CET	15032	49907	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:56.541384935 CET	49907	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.571055889 CET	49907	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.782215118 CET	49907	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.854511976 CET	15032	49907	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:56.854557991 CET	15032	49907	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:56.854691982 CET	49907	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.855510950 CET	49907	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.857769966 CET	49908	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:56.881347895 CET	15032	49907	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.093087912 CET	15032	49907	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.165107012 CET	15032	49907	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.171458006 CET	15032	49908	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.171770096 CET	49908	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:57.205033064 CET	49908	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:57.406363010 CET	49908	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:57.485475063 CET	15032	49908	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.485642910 CET	49908	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:57.485704899 CET	15032	49908	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.485759020 CET	49908	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:57.486589909 CET	49908	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:57.488790989 CET	49909	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:57.518448114 CET	15032	49908	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.721162081 CET	15032	49908	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.799206972 CET	15032	49908	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.799323082 CET	15032	49908	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.803971052 CET	15032	49909	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:57.808482885 CET	49909	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:57.850069046 CET	49909	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.020845890 CET	49909	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.122361898 CET	15032	49909	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.122442961 CET	15032	49909	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.122456074 CET	49909	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.122545004 CET	49909	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.123310089 CET	49909	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.125231981 CET	49910	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.162873030 CET	15032	49909	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.333704948 CET	15032	49909	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.435275078 CET	15032	49909	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.435318947 CET	15032	49909	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.436594963 CET	15032	49910	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.436697960 CET	49910	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.465379953 CET	49910	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.670898914 CET	49910	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.748500109 CET	15032	49910	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.748564005 CET	15032	49910	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.748584986 CET	49910	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.748610973 CET	49910	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.749202967 CET	49910	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.751272917 CET	49911	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:58.776993036 CET	15032	49910	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:58.982649088 CET	15032	49910	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.060198069 CET	15032	49910	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.060220957 CET	15032	49910	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.067301989 CET	15032	49911	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.069040060 CET	49911	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:59.102209091 CET	49911	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:59.296458006 CET	49911	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:59.385617018 CET	15032	49911	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.385648012 CET	15032	49911	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.385706902 CET	49911	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:59.385746002 CET	49911	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:59.386699915 CET	49911	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:59.388653040 CET	49912	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:59.418252945 CET	15032	49911	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.612447977 CET	15032	49911	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.701683998 CET	15032	49911	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.701952934 CET	15032	49911	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.702631950 CET	15032	49912	3.6.98.232	192.168.2.4
Feb 9, 2024 22:14:59.705980062 CET	49912	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:59.737123013 CET	49912	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:14:59.929394007 CET	49912	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.020390987 CET	15032	49912	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.020411968 CET	15032	49912	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.020534039 CET	49912	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.021956921 CET	49912	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.023803949 CET	49913	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.051029921 CET	15032	49912	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.243459940 CET	15032	49912	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.330302954 CET	15032	49913	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.330382109 CET	49913	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.334429979 CET	15032	49912	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.371843100 CET	49913	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.602129936 CET	49913	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.637254953 CET	15032	49913	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.637295008 CET	15032	49913	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.637388945 CET	49913	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.637389898 CET	49913	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.638804913 CET	49913	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.640844107 CET	49914	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.678515911 CET	15032	49913	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.908701897 CET	15032	49913	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.943882942 CET	15032	49913	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.943903923 CET	15032	49913	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.952053070 CET	15032	49914	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:00.952174902 CET	49914	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:00.983047962 CET	49914	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.185844898 CET	49914	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.264228106 CET	15032	49914	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:01.264242887 CET	15032	49914	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:01.264308929 CET	49914	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.265528917 CET	49914	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.267601013 CET	49915	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.294230938 CET	15032	49914	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:01.496978998 CET	15032	49914	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:01.576284885 CET	15032	49914	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:01.577188015 CET	15032	49915	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:01.577276945 CET	49915	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.617600918 CET	49915	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.830416918 CET	49915	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.887084007 CET	15032	49915	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:01.887130976 CET	15032	49915	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:01.887357950 CET	49915	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.890897036 CET	49915	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.902055025 CET	49916	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:01.927923918 CET	15032	49915	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.140031099 CET	15032	49915	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.196873903 CET	15032	49915	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.214668036 CET	15032	49916	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.214745998 CET	49916	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:02.262167931 CET	49916	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:02.495790005 CET	49916	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:02.527656078 CET	15032	49916	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.527689934 CET	15032	49916	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.527784109 CET	49916	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:02.528903961 CET	49916	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:02.530920029 CET	49917	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:02.574702978 CET	15032	49916	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.808386087 CET	15032	49916	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.840296030 CET	15032	49916	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.846899033 CET	15032	49917	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:02.848612070 CET	49917	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:02.875444889 CET	49917	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.061168909 CET	49917	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.165148020 CET	15032	49917	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.165169954 CET	15032	49917	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.165260077 CET	49917	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.165326118 CET	49917	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.166635990 CET	49917	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.168899059 CET	49918	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.191812038 CET	15032	49917	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.377279997 CET	15032	49917	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.481312037 CET	15032	49917	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.481353045 CET	15032	49917	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.481580019 CET	15032	49918	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.481760979 CET	49918	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.547852039 CET	49918	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.794806004 CET	15032	49918	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.794826031 CET	15032	49918	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.795036077 CET	49918	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.860584021 CET	15032	49918	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:03.974431038 CET	49918	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:03.976924896 CET	49919	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:04.107743025 CET	15032	49918	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:04.286885023 CET	15032	49919	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:04.287324905 CET	49919	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:04.597629070 CET	15032	49919	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:04.597671986 CET	15032	49919	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:04.597748995 CET	49919	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:05.716968060 CET	49919	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:05.717662096 CET	49919	15032	192.168.2.4	3.6.98.232
Feb 9, 2024 22:15:05.858561039 CET	49920	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:06.027190924 CET	15032	49919	3.6.98.232	192.168.2.4
Feb 9, 2024 22:15:06.168471098 CET	15032	49920	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:06.168668032 CET	49920	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:06.225141048 CET	49920	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:06.446192026 CET	49920	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:06.478758097 CET	15032	49920	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:06.478776932 CET	15032	49920	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:06.478981018 CET	49920	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:06.479976892 CET	49920	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:06.482094049 CET	49921	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:06.535010099 CET	15032	49920	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:06.756190062 CET	15032	49920	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:06.756210089 CET	15032	49920	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:06.788794994 CET	15032	49920	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:06.791738987 CET	15032	49921	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:06.794049978 CET	49921	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:06.819261074 CET	49921	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:06.986994982 CET	49921	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.104401112 CET	15032	49921	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:07.104470015 CET	15032	49921	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:07.104712963 CET	49921	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.106112003 CET	49921	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.108496904 CET	49922	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.129213095 CET	15032	49921	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:07.296940088 CET	15032	49921	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:07.414421082 CET	15032	49921	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:07.418329954 CET	15032	49922	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:07.418416023 CET	49922	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.462425947 CET	49922	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.691386938 CET	49922	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.728563070 CET	15032	49922	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:07.728585958 CET	15032	49922	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:07.728638887 CET	49922	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.728677988 CET	49922	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.729495049 CET	49922	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.731441021 CET	49923	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:07.772537947 CET	15032	49922	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.001966000 CET	15032	49922	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.037211895 CET	15032	49923	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.037292957 CET	49923	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.038364887 CET	15032	49922	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.038439989 CET	15032	49922	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.075145960 CET	49923	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.343278885 CET	15032	49923	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.343295097 CET	15032	49923	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.343349934 CET	49923	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.343379974 CET	49923	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.343951941 CET	49923	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.345504999 CET	49924	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.380968094 CET	15032	49923	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.649240971 CET	15032	49923	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.649271965 CET	15032	49923	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.658453941 CET	15032	49924	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.659986973 CET	49924	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.692606926 CET	49924	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.886523008 CET	49924	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.973074913 CET	15032	49924	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.973123074 CET	15032	49924	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:08.973205090 CET	49924	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.974378109 CET	49924	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:08.976490974 CET	49925	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:09.005445957 CET	15032	49924	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.199434996 CET	15032	49924	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.285958052 CET	15032	49924	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.292820930 CET	15032	49925	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.292893887 CET	49925	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:09.324630022 CET	49925	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:09.499150038 CET	49925	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:09.609407902 CET	15032	49925	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.609430075 CET	15032	49925	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.609538078 CET	49925	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:09.610687017 CET	49925	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:09.622024059 CET	49926	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:09.640887022 CET	15032	49925	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.815466881 CET	15032	49925	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.925937891 CET	15032	49925	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.928817034 CET	15032	49926	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:09.928962946 CET	49926	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:09.952476025 CET	49926	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.127291918 CET	49926	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.235985041 CET	15032	49926	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:10.236005068 CET	15032	49926	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:10.236191988 CET	49926	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.236191988 CET	49926	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.236932039 CET	49926	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.239495039 CET	49927	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.259241104 CET	15032	49926	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:10.434194088 CET	15032	49926	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:10.543050051 CET	15032	49926	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:10.543066025 CET	15032	49926	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:10.556622028 CET	15032	49927	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:10.556689024 CET	49927	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.603445053 CET	49927	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.793601036 CET	49927	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.874063969 CET	15032	49927	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:10.874191999 CET	49927	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.874218941 CET	15032	49927	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:10.874263048 CET	49927	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.875236034 CET	49927	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.877151012 CET	49928	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:10.920536041 CET	15032	49927	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.110780954 CET	15032	49927	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.185679913 CET	15032	49928	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.185820103 CET	49928	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:11.191323042 CET	15032	49927	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.191333055 CET	15032	49927	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.219074011 CET	49928	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:11.419804096 CET	49928	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:11.496650934 CET	15032	49928	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.496676922 CET	15032	49928	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.496905088 CET	49928	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:11.515014887 CET	49928	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:11.517261982 CET	49929	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:11.527539968 CET	15032	49928	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.728411913 CET	15032	49928	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.728430033 CET	15032	49928	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.805411100 CET	15032	49928	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.832679033 CET	15032	49929	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:11.837999105 CET	49929	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:11.863673925 CET	49929	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.048346043 CET	49929	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.153700113 CET	15032	49929	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:12.153728962 CET	15032	49929	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:12.153883934 CET	49929	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.154860973 CET	49929	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.156867981 CET	49930	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.179012060 CET	15032	49929	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:12.363784075 CET	15032	49929	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:12.465929031 CET	15032	49930	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:12.465990067 CET	49930	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.469259024 CET	15032	49929	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:12.504472971 CET	49930	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.694720984 CET	49930	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.775317907 CET	15032	49930	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:12.775332928 CET	15032	49930	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:12.775422096 CET	49930	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.776331902 CET	49930	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.778280020 CET	49931	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:12.813503981 CET	15032	49930	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.003809929 CET	15032	49930	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.003825903 CET	15032	49930	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.084582090 CET	15032	49930	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.084919930 CET	15032	49931	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.085000992 CET	49931	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:13.110090017 CET	49931	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:13.316248894 CET	49931	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:13.393660069 CET	15032	49931	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.393680096 CET	15032	49931	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.393713951 CET	49931	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:13.393723011 CET	49931	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:13.394773960 CET	49931	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:13.396172047 CET	49932	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:13.416951895 CET	15032	49931	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.623022079 CET	15032	49931	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.623037100 CET	15032	49931	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.700478077 CET	15032	49931	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.700489998 CET	15032	49931	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.711924076 CET	15032	49932	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:13.713942051 CET	49932	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:13.742161036 CET	49932	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:13.913891077 CET	49932	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.029979944 CET	15032	49932	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.029999971 CET	15032	49932	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.030056953 CET	49932	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.030155897 CET	49932	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.030744076 CET	49932	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.032609940 CET	49933	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.057992935 CET	15032	49932	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.229842901 CET	15032	49932	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.229943991 CET	15032	49932	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.344259977 CET	15032	49933	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.344345093 CET	49933	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.345746040 CET	15032	49932	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.345757961 CET	15032	49932	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.380388975 CET	49933	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.612423897 CET	49933	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.656456947 CET	15032	49933	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.656481028 CET	15032	49933	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.656596899 CET	49933	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.657605886 CET	49933	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.659699917 CET	49934	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:14.692540884 CET	15032	49933	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.924330950 CET	15032	49933	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.924350977 CET	15032	49933	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.968488932 CET	15032	49933	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.973885059 CET	15032	49934	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:14.976615906 CET	49934	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.001003981 CET	49934	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.192066908 CET	49934	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.290868998 CET	15032	49934	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:15.290951014 CET	49934	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.291008949 CET	15032	49934	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:15.291052103 CET	49934	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.291568041 CET	49934	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.293428898 CET	49935	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.315120935 CET	15032	49934	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:15.506428003 CET	15032	49934	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:15.600951910 CET	15032	49935	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:15.601033926 CET	49935	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.605006933 CET	15032	49934	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:15.605017900 CET	15032	49934	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:15.634356022 CET	49935	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.861903906 CET	49935	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.908339977 CET	15032	49935	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:15.908356905 CET	15032	49935	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:15.908478022 CET	49935	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.909379005 CET	49935	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.911217928 CET	49936	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:15.941546917 CET	15032	49935	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.169711113 CET	15032	49935	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.215812922 CET	15032	49935	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.221985102 CET	15032	49936	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.224153042 CET	49936	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:16.252129078 CET	49936	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:16.479378939 CET	49936	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:16.534923077 CET	15032	49936	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.535043955 CET	15032	49936	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.535093069 CET	49936	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:16.535093069 CET	49936	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:16.536179066 CET	49936	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:16.539191008 CET	49937	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:16.562395096 CET	15032	49936	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.789988041 CET	15032	49936	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.845669985 CET	15032	49936	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.845729113 CET	15032	49936	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.849096060 CET	15032	49937	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:16.849297047 CET	49937	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:16.891844034 CET	49937	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.073210955 CET	49937	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.159506083 CET	15032	49937	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:17.159555912 CET	15032	49937	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:17.159778118 CET	49937	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.160366058 CET	49937	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.162566900 CET	49938	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.201936007 CET	15032	49937	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:17.383264065 CET	15032	49937	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:17.468144894 CET	15032	49938	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:17.468394041 CET	49938	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.469630957 CET	15032	49937	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:17.503284931 CET	49938	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.698297977 CET	49938	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.774275064 CET	15032	49938	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:17.774288893 CET	15032	49938	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:17.775002956 CET	49938	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.775002956 CET	49938	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.777168989 CET	49939	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:17.808964014 CET	15032	49938	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.003930092 CET	15032	49938	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.080562115 CET	15032	49938	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.087625980 CET	15032	49939	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.089087963 CET	49939	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:18.119215012 CET	49939	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:18.313137054 CET	49939	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:18.399832964 CET	15032	49939	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.399878025 CET	15032	49939	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.399930000 CET	49939	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:18.399959087 CET	49939	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:18.400721073 CET	49939	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:18.402796030 CET	49940	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:18.429621935 CET	15032	49939	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.623661995 CET	15032	49939	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.710443974 CET	15032	49939	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.710484028 CET	15032	49939	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.715334892 CET	15032	49940	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:18.715409994 CET	49940	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:18.876727104 CET	49940	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.028238058 CET	15032	49940	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.028280020 CET	15032	49940	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.028461933 CET	49940	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.029465914 CET	49940	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.031455994 CET	49941	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.189235926 CET	15032	49940	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.341021061 CET	15032	49940	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.347054005 CET	15032	49941	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.347177982 CET	49941	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.382936954 CET	49941	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.632599115 CET	49941	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.665230036 CET	15032	49941	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.665273905 CET	15032	49941	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.665340900 CET	49941	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.665394068 CET	49941	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.666306019 CET	49941	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.668550014 CET	49942	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:19.698695898 CET	15032	49941	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.948214054 CET	15032	49941	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.980963945 CET	15032	49941	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.981148958 CET	15032	49941	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.981496096 CET	15032	49942	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:19.982085943 CET	49942	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.021836996 CET	49942	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.216685057 CET	49942	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.295304060 CET	15032	49942	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.295352936 CET	15032	49942	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.295396090 CET	49942	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.295411110 CET	49942	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.296489954 CET	49942	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.298448086 CET	49943	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.334642887 CET	15032	49942	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.529468060 CET	15032	49942	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.605000973 CET	15032	49943	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.605195045 CET	49943	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.608185053 CET	15032	49942	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.608196974 CET	15032	49942	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.633040905 CET	49943	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.912034035 CET	15032	49943	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.912080050 CET	15032	49943	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.912210941 CET	49943	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.939567089 CET	15032	49943	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:20.945542097 CET	49943	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:20.947182894 CET	49944	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:21.218919039 CET	15032	49943	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:21.261284113 CET	15032	49944	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:21.264152050 CET	49944	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:21.525805950 CET	49944	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:21.578475952 CET	15032	49944	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:21.578490973 CET	15032	49944	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:21.578696012 CET	49944	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:21.592315912 CET	49944	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:21.593929052 CET	49945	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:21.839890003 CET	15032	49944	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:21.892818928 CET	15032	49944	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:21.903789043 CET	15032	49945	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:21.904082060 CET	49945	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:22.214175940 CET	15032	49945	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:22.214193106 CET	15032	49945	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:22.214384079 CET	49945	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.169528008 CET	49945	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.170818090 CET	49945	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.172771931 CET	49946	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.479374886 CET	15032	49945	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:23.484486103 CET	15032	49946	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:23.484637976 CET	49946	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.519655943 CET	49946	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.709846973 CET	49946	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.796672106 CET	15032	49946	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:23.796685934 CET	15032	49946	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:23.796737909 CET	49946	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.796756029 CET	49946	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.797378063 CET	49946	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.799139023 CET	49947	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:23.831332922 CET	15032	49946	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.021627903 CET	15032	49946	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.108470917 CET	15032	49946	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.108485937 CET	15032	49946	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.108799934 CET	15032	49947	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.108911037 CET	49947	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:24.144088984 CET	49947	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:24.347035885 CET	49947	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:24.418787956 CET	15032	49947	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.418807983 CET	15032	49947	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.418843031 CET	49947	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:24.418853998 CET	49947	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:24.419656038 CET	49947	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:24.421686888 CET	49948	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:24.453747988 CET	15032	49947	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.656821012 CET	15032	49947	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.727406979 CET	15032	49948	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.727514982 CET	49948	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:24.728425026 CET	15032	49947	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.728461027 CET	15032	49947	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:24.769340992 CET	49948	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:24.955188036 CET	49948	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.033571005 CET	15032	49948	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.033587933 CET	15032	49948	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.033730984 CET	49948	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.034754038 CET	49948	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.036654949 CET	49949	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.075171947 CET	15032	49948	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.261260033 CET	15032	49948	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.339684010 CET	15032	49948	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.343569994 CET	15032	49949	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.343645096 CET	49949	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.384399891 CET	49949	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.615299940 CET	49949	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.650753975 CET	15032	49949	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.650772095 CET	15032	49949	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.650873899 CET	49949	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.652085066 CET	49949	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.654486895 CET	49950	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.691560984 CET	15032	49949	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.922275066 CET	15032	49949	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.957896948 CET	15032	49949	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.964734077 CET	15032	49950	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:25.966036081 CET	49950	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:25.995374918 CET	49950	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.211999893 CET	49950	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.276495934 CET	15032	49950	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:26.276510000 CET	15032	49950	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:26.276619911 CET	49950	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.277821064 CET	49950	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.279819965 CET	49951	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.305591106 CET	15032	49950	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:26.522228003 CET	15032	49950	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:26.586853981 CET	15032	49950	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:26.586966991 CET	15032	49951	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:26.587028027 CET	49951	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.618073940 CET	49951	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.862752914 CET	49951	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.894665956 CET	15032	49951	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:26.894694090 CET	15032	49951	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:26.894908905 CET	49951	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.895945072 CET	49951	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.898046970 CET	49952	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:26.925445080 CET	15032	49951	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.170248032 CET	15032	49951	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.202111959 CET	15032	49951	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.207994938 CET	15032	49952	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.208928108 CET	49952	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:27.235300064 CET	49952	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:27.484014034 CET	49952	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:27.519534111 CET	15032	49952	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.519562960 CET	15032	49952	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.519721031 CET	49952	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:27.519721031 CET	49952	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:27.520657063 CET	49952	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:27.522669077 CET	49953	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:27.545084000 CET	15032	49952	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.793894053 CET	15032	49952	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.829503059 CET	15032	49952	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.829607964 CET	15032	49952	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.836389065 CET	15032	49953	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:27.838745117 CET	49953	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:27.873611927 CET	49953	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.059062004 CET	49953	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.152895927 CET	15032	49953	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.152909994 CET	15032	49953	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.152992964 CET	49953	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.154153109 CET	49953	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.156425953 CET	49954	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.187338114 CET	15032	49953	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.372793913 CET	15032	49953	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.372833967 CET	15032	49953	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.462214947 CET	15032	49954	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.462316036 CET	49954	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.466856956 CET	15032	49953	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.524283886 CET	49954	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.687832117 CET	49954	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.768507004 CET	15032	49954	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.768520117 CET	15032	49954	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.768635988 CET	49954	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.769435883 CET	49954	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.771693945 CET	49955	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:28.830171108 CET	15032	49954	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:28.993669987 CET	15032	49954	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.074408054 CET	15032	49954	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.082717896 CET	15032	49955	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.082959890 CET	49955	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:29.110272884 CET	49955	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:29.291630030 CET	49955	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:29.394287109 CET	15032	49955	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.394339085 CET	15032	49955	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.394386053 CET	49955	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:29.394408941 CET	49955	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:29.395571947 CET	49955	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:29.397363901 CET	49956	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:29.421379089 CET	15032	49955	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.602782965 CET	15032	49955	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.705765963 CET	15032	49955	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.705786943 CET	15032	49955	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.710464001 CET	15032	49956	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:29.710556030 CET	49956	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:29.739104033 CET	49956	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:29.930850029 CET	49956	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.024519920 CET	15032	49956	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.024543047 CET	15032	49956	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.024630070 CET	49956	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.032361031 CET	49956	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.034646034 CET	49957	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.052213907 CET	15032	49956	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.244091034 CET	15032	49956	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.338013887 CET	15032	49956	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.340989113 CET	15032	49957	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.341139078 CET	49957	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.372829914 CET	49957	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.567295074 CET	49957	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.647910118 CET	15032	49957	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.647928953 CET	15032	49957	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.648025990 CET	49957	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.649203062 CET	49957	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.651391983 CET	49958	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.679203033 CET	15032	49957	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.873728037 CET	15032	49957	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.954781055 CET	15032	49957	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.967648029 CET	15032	49958	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:30.968743086 CET	49958	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:30.994596004 CET	49958	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.273235083 CET	49958	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.285121918 CET	15032	49958	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:31.285140991 CET	15032	49958	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:31.285459995 CET	49958	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.286324024 CET	49958	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.290467024 CET	49959	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.310733080 CET	15032	49958	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:31.589555979 CET	15032	49958	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:31.601046085 CET	15032	49959	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:31.601125956 CET	49959	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.601531982 CET	15032	49958	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:31.648521900 CET	49959	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.872919083 CET	49959	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.911694050 CET	15032	49959	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:31.911712885 CET	15032	49959	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:31.911928892 CET	49959	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.915437937 CET	49959	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.918853045 CET	49960	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:31.959121943 CET	15032	49959	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.183523893 CET	15032	49959	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.222774029 CET	15032	49959	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.234695911 CET	15032	49960	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.234854937 CET	49960	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:32.292681932 CET	49960	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:32.515835047 CET	49960	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:32.544019938 CET	15032	49960	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.544055939 CET	15032	49960	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.544096947 CET	49960	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:32.544117928 CET	49960	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:32.544850111 CET	49960	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:32.547194004 CET	49961	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:32.601639986 CET	15032	49960	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.824913979 CET	15032	49960	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.853138924 CET	15032	49960	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.853424072 CET	15032	49960	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.854301929 CET	15032	49961	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:32.857954979 CET	49961	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:32.891267061 CET	49961	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.116321087 CET	49961	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.165427923 CET	15032	49961	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:33.165445089 CET	15032	49961	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:33.165514946 CET	49961	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.166503906 CET	49961	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.168154955 CET	49962	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.198360920 CET	15032	49961	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:33.423790932 CET	15032	49961	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:33.472595930 CET	15032	49961	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:33.475543022 CET	15032	49962	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:33.475682020 CET	49962	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.515753984 CET	49962	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.738578081 CET	49962	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.783313990 CET	15032	49962	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:33.783328056 CET	15032	49962	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:33.783402920 CET	49962	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.785389900 CET	49962	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.787844896 CET	49963	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:33.823132038 CET	15032	49962	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.047158003 CET	15032	49962	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.047172070 CET	15032	49962	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.090867043 CET	15032	49962	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.097882032 CET	15032	49963	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.100141048 CET	49963	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:34.143364906 CET	49963	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:34.393883944 CET	49963	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:34.410387039 CET	15032	49963	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.410414934 CET	15032	49963	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.410469055 CET	49963	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:34.410518885 CET	49963	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:34.411504984 CET	49963	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:34.414060116 CET	49964	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:34.453891993 CET	15032	49963	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.703880072 CET	15032	49963	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.720336914 CET	15032	49963	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.720371008 CET	15032	49963	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.729446888 CET	15032	49964	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:34.729543924 CET	49964	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:34.761862993 CET	49964	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:34.984909058 CET	49964	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:35.045823097 CET	15032	49964	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.045844078 CET	15032	49964	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.045923948 CET	49964	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:35.047209024 CET	49964	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:35.049221992 CET	49965	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:35.078294039 CET	15032	49964	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.300379992 CET	15032	49964	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.360888004 CET	15032	49965	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.361608028 CET	15032	49964	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.361737967 CET	49965	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:35.432611942 CET	49965	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:35.673571110 CET	15032	49965	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.673607111 CET	15032	49965	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.673876047 CET	49965	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:35.674782038 CET	49965	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:35.676886082 CET	49966	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:35.744249105 CET	15032	49965	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.985876083 CET	15032	49965	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.992341042 CET	15032	49966	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:35.996361017 CET	49966	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.035366058 CET	49966	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.283787966 CET	49966	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.311994076 CET	15032	49966	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:36.312021971 CET	15032	49966	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:36.312149048 CET	49966	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.314306021 CET	49966	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.317049026 CET	49967	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.351154089 CET	15032	49966	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:36.599461079 CET	15032	49966	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:36.627557993 CET	15032	49966	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:36.633301020 CET	15032	49967	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:36.633399963 CET	49967	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.674158096 CET	49967	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.899540901 CET	49967	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.950066090 CET	15032	49967	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:36.950094938 CET	15032	49967	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:36.950170994 CET	49967	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.950170994 CET	49967	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.951097965 CET	49967	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.953366995 CET	49968	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:36.990602970 CET	15032	49967	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.216459036 CET	15032	49967	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.259876013 CET	15032	49968	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.260587931 CET	49968	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:37.266376019 CET	15032	49967	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.266388893 CET	15032	49967	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.296303988 CET	49968	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:37.527682066 CET	49968	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:37.567274094 CET	15032	49968	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.567289114 CET	15032	49968	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.567347050 CET	49968	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:37.568131924 CET	49968	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:37.569957972 CET	49969	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:37.602963924 CET	15032	49968	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.834176064 CET	15032	49968	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.873752117 CET	15032	49968	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.884418011 CET	15032	49969	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:37.884620905 CET	49969	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:37.915276051 CET	49969	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.108562946 CET	49969	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.198714018 CET	15032	49969	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:38.198731899 CET	15032	49969	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:38.198951006 CET	49969	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.199934959 CET	49969	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.201715946 CET	49970	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.229065895 CET	15032	49969	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:38.422404051 CET	15032	49969	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:38.506805897 CET	15032	49970	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:38.506896973 CET	49970	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.512758970 CET	15032	49969	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:38.533574104 CET	49970	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.736216068 CET	49970	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.812341928 CET	15032	49970	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:38.812386036 CET	15032	49970	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:38.812813044 CET	49970	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.813502073 CET	49970	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.815645933 CET	49971	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:38.838799953 CET	15032	49970	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.041491985 CET	15032	49970	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.117947102 CET	15032	49970	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.129363060 CET	15032	49971	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.131799936 CET	49971	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:39.170810938 CET	49971	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:39.336874962 CET	49971	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:39.445755959 CET	15032	49971	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.445800066 CET	15032	49971	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.445863008 CET	49971	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:39.446094990 CET	49971	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:39.446552992 CET	49971	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:39.448477030 CET	49972	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:39.484504938 CET	15032	49971	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.650621891 CET	15032	49971	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.760117054 CET	15032	49971	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.760133982 CET	15032	49971	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.765635967 CET	15032	49972	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:39.765712976 CET	49972	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:39.808799028 CET	49972	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.002515078 CET	49972	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.081931114 CET	15032	49972	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:40.081962109 CET	15032	49972	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:40.082093000 CET	49972	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.082791090 CET	49972	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.084975958 CET	49973	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.124593973 CET	15032	49972	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:40.318487883 CET	15032	49972	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:40.392347097 CET	15032	49973	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:40.392582893 CET	49973	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.397850990 CET	15032	49972	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:40.435805082 CET	49973	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.642501116 CET	49973	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.699991941 CET	15032	49973	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:40.700010061 CET	15032	49973	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:40.700104952 CET	49973	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.701303959 CET	49973	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.703181982 CET	49974	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:40.743252039 CET	15032	49973	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:40.950025082 CET	15032	49973	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.007592916 CET	15032	49973	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.019120932 CET	15032	49974	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.019205093 CET	49974	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.051269054 CET	49974	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.223315001 CET	49974	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.335503101 CET	15032	49974	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.335534096 CET	15032	49974	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.335654974 CET	49974	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.336625099 CET	49974	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.338383913 CET	49975	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.367115974 CET	15032	49974	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.539238930 CET	15032	49974	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.539271116 CET	15032	49974	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.651581049 CET	15032	49974	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.654438019 CET	15032	49975	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.654501915 CET	49975	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.710369110 CET	49975	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.911669970 CET	49975	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.970892906 CET	15032	49975	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.970916033 CET	15032	49975	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:41.970980883 CET	49975	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.971781015 CET	49975	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.971781015 CET	49975	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:41.973828077 CET	49976	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:42.026407957 CET	15032	49975	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.227777004 CET	15032	49975	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.287142038 CET	15032	49975	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.287739992 CET	15032	49975	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.288049936 CET	15032	49976	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.288115025 CET	49976	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:42.317142963 CET	49976	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:42.489483118 CET	49976	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:42.603705883 CET	15032	49976	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.603730917 CET	15032	49976	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.603813887 CET	49976	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:42.607227087 CET	49976	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:42.609622002 CET	49977	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:42.631387949 CET	15032	49976	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.803852081 CET	15032	49976	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.917032003 CET	15032	49977	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.917109013 CET	49977	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:42.918098927 CET	15032	49976	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:42.958157063 CET	49977	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.124317884 CET	49977	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.224920034 CET	15032	49977	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:43.224948883 CET	15032	49977	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:43.225212097 CET	49977	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.226180077 CET	49977	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.228513956 CET	49978	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.267321110 CET	15032	49977	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:43.433871031 CET	15032	49977	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:43.532627106 CET	15032	49977	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:43.542825937 CET	15032	49978	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:43.542901993 CET	49978	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.571979046 CET	49978	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.772620916 CET	49978	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.857391119 CET	15032	49978	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:43.857407093 CET	15032	49978	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:43.857528925 CET	49978	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.858460903 CET	49978	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.860459089 CET	49979	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:43.886255980 CET	15032	49978	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.087073088 CET	15032	49978	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.170228958 CET	15032	49979	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.171744108 CET	15032	49978	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.171894073 CET	49979	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:44.200180054 CET	49979	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:44.372462034 CET	49979	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:44.482621908 CET	15032	49979	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.482636929 CET	15032	49979	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.482698917 CET	49979	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:44.482788086 CET	49979	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:44.483495951 CET	49979	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:44.485150099 CET	49980	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:44.510307074 CET	15032	49979	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.682384968 CET	15032	49979	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.793308020 CET	15032	49979	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.793884993 CET	15032	49979	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.796380043 CET	15032	49980	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:44.796463966 CET	49980	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:44.827317953 CET	49980	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:44.998512983 CET	49980	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.106801033 CET	15032	49980	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:45.106813908 CET	15032	49980	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:45.106946945 CET	49980	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.108088970 CET	49980	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.110452890 CET	49981	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.137140989 CET	15032	49980	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:45.308413029 CET	15032	49980	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:45.416821957 CET	15032	49980	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:45.417470932 CET	15032	49981	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:45.417560101 CET	49981	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.441894054 CET	49981	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.655513048 CET	49981	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.724745989 CET	15032	49981	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:45.724773884 CET	15032	49981	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:45.724806070 CET	49981	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.724816084 CET	49981	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.725658894 CET	49981	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.727025032 CET	49982	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:45.749038935 CET	15032	49981	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:45.962650061 CET	15032	49981	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.031881094 CET	15032	49981	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.031898022 CET	15032	49981	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.033979893 CET	15032	49982	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.037252903 CET	49982	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.071527004 CET	49982	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.252353907 CET	49982	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.344497919 CET	15032	49982	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.344512939 CET	15032	49982	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.344575882 CET	49982	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.345747948 CET	49982	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.347035885 CET	49983	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.378837109 CET	15032	49982	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.559456110 CET	15032	49982	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.651597977 CET	15032	49982	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.656774044 CET	15032	49983	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.656841040 CET	49983	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.689639091 CET	49983	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.874708891 CET	49983	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.966830969 CET	15032	49983	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.966847897 CET	15032	49983	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:46.966912985 CET	49983	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.967036009 CET	49983	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.967981100 CET	49983	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.969188929 CET	49984	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:46.999362946 CET	15032	49983	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.184557915 CET	15032	49983	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.276674032 CET	15032	49983	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.276839972 CET	15032	49983	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.279926062 CET	15032	49984	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.280294895 CET	49984	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:47.307585001 CET	49984	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:47.543018103 CET	49984	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:47.591440916 CET	15032	49984	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.591455936 CET	15032	49984	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.591507912 CET	49984	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:47.592442989 CET	49984	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:47.594374895 CET	49985	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:47.618304968 CET	15032	49984	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.853755951 CET	15032	49984	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.902323008 CET	15032	49984	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.904530048 CET	15032	49985	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:47.904624939 CET	49985	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:47.933358908 CET	49985	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.127230883 CET	49985	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.215004921 CET	15032	49985	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:48.215017080 CET	15032	49985	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:48.215110064 CET	49985	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.216216087 CET	49985	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.218575001 CET	49986	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.243596077 CET	15032	49985	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:48.437570095 CET	15032	49985	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:48.525305986 CET	15032	49985	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:48.525537014 CET	15032	49986	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:48.525733948 CET	49986	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.553356886 CET	49986	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.761926889 CET	49986	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.832736969 CET	15032	49986	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:48.832787991 CET	15032	49986	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:48.833058119 CET	49986	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.833952904 CET	49986	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.835746050 CET	49987	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:48.873404980 CET	15032	49986	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.068840027 CET	15032	49986	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.140002966 CET	15032	49986	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.151509047 CET	15032	49987	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.153947115 CET	49987	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:49.186603069 CET	49987	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:49.372505903 CET	49987	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:49.470004082 CET	15032	49987	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.470016956 CET	15032	49987	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.470103025 CET	49987	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:49.471295118 CET	49987	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:49.473488092 CET	49988	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:49.502332926 CET	15032	49987	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.688335896 CET	15032	49987	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.781549931 CET	15032	49988	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.781639099 CET	49988	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:49.785820007 CET	15032	49987	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:49.846540928 CET	49988	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.050755978 CET	49988	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.089884043 CET	15032	49988	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.089905024 CET	15032	49988	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.090084076 CET	49988	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.091244936 CET	49988	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.093476057 CET	49989	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.154815912 CET	15032	49988	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.359025002 CET	15032	49988	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.359047890 CET	15032	49988	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.398128986 CET	15032	49988	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.399748087 CET	15032	49989	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.399856091 CET	49989	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.423352003 CET	49989	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.639012098 CET	49989	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.706278086 CET	15032	49989	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.706293106 CET	15032	49989	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.706358910 CET	49989	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.706376076 CET	49989	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.707514048 CET	49989	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.709496021 CET	49990	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:50.729617119 CET	15032	49989	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:50.945249081 CET	15032	49989	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.012590885 CET	15032	49989	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.012602091 CET	15032	49989	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.020381927 CET	15032	49990	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.021939039 CET	49990	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.052510023 CET	49990	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.221138000 CET	49990	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.332582951 CET	15032	49990	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.332595110 CET	15032	49990	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.332813978 CET	49990	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.333761930 CET	49990	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.335598946 CET	49991	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.362991095 CET	15032	49990	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.531619072 CET	15032	49990	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.531630993 CET	15032	49990	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.643253088 CET	15032	49990	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.645397902 CET	15032	49991	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.645541906 CET	49991	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.676223993 CET	49991	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.863142967 CET	49991	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.955605030 CET	15032	49991	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.955620050 CET	15032	49991	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:51.955681086 CET	49991	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.955681086 CET	49991	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.956737041 CET	49991	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.958544970 CET	49992	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:51.986067057 CET	15032	49991	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.172974110 CET	15032	49991	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.265952110 CET	15032	49991	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.265985012 CET	15032	49991	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.269530058 CET	15032	49992	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.273955107 CET	49992	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:52.295562983 CET	49992	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:52.494606972 CET	49992	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:52.585274935 CET	15032	49992	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.585297108 CET	15032	49992	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.585418940 CET	49992	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:52.585418940 CET	49992	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:52.586133003 CET	49992	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:52.588043928 CET	49993	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:52.606539011 CET	15032	49992	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.805675983 CET	15032	49992	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.896496058 CET	15032	49992	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.896580935 CET	15032	49992	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.904161930 CET	15032	49993	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:52.904228926 CET	49993	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:52.948648930 CET	49993	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.127934933 CET	49993	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.220530987 CET	15032	49993	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:53.220551014 CET	15032	49993	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:53.220674992 CET	49993	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.221553087 CET	49993	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.223676920 CET	49994	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.265007019 CET	15032	49993	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:53.444072008 CET	15032	49993	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:53.536917925 CET	15032	49993	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:53.539829016 CET	15032	49994	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:53.540251970 CET	49994	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.567362070 CET	49994	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.757440090 CET	49994	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.856584072 CET	15032	49994	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:53.856610060 CET	15032	49994	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:53.856676102 CET	49994	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.856692076 CET	49994	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.857445955 CET	49994	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.859672070 CET	49995	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:53.883527994 CET	15032	49994	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.073649883 CET	15032	49994	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.169488907 CET	15032	49995	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.172029018 CET	49995	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:54.172875881 CET	15032	49994	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.172892094 CET	15032	49994	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.196845055 CET	49995	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:54.370636940 CET	49995	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:54.481988907 CET	15032	49995	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.482007980 CET	15032	49995	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.482214928 CET	49995	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:54.483108997 CET	49995	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:54.485367060 CET	49996	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:54.508173943 CET	15032	49995	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.680527925 CET	15032	49995	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.792018890 CET	15032	49995	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.802097082 CET	15032	49996	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:54.802326918 CET	49996	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:54.830912113 CET	49996	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.008104086 CET	49996	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.117223978 CET	15032	49996	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.117252111 CET	15032	49996	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.117414951 CET	49996	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.117414951 CET	49996	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.118011951 CET	49996	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.120049000 CET	49997	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.145227909 CET	15032	49996	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.322660923 CET	15032	49996	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.427063942 CET	15032	49997	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.427211046 CET	49997	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.431904078 CET	15032	49996	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.431921005 CET	15032	49996	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.455002069 CET	49997	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.628839970 CET	49997	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.734458923 CET	15032	49997	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.734493971 CET	15032	49997	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.734524012 CET	49997	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.734601021 CET	49997	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.735284090 CET	49997	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.737390041 CET	49998	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:55.762015104 CET	15032	49997	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:55.935897112 CET	15032	49997	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.041718960 CET	15032	49997	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.041735888 CET	15032	49997	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.042989969 CET	15032	49998	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.043077946 CET	49998	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.071460962 CET	49998	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.247597933 CET	49998	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.348886013 CET	15032	49998	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.348906994 CET	15032	49998	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.348995924 CET	49998	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.349894047 CET	49998	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.351397038 CET	49999	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.377106905 CET	15032	49998	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.553554058 CET	15032	49998	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.654702902 CET	15032	49998	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.661009073 CET	15032	49999	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.661175013 CET	49999	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.715373039 CET	49999	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.914530039 CET	49999	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.971004963 CET	15032	49999	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.971020937 CET	15032	49999	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:56.971065998 CET	49999	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.971075058 CET	49999	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.972516060 CET	49999	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:56.976206064 CET	50000	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:57.024972916 CET	15032	49999	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.224381924 CET	15032	49999	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.224396944 CET	15032	49999	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.280747890 CET	15032	49999	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.280761003 CET	15032	49999	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.289072990 CET	15032	50000	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.289992094 CET	50000	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:57.320688963 CET	50000	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:57.570413113 CET	50000	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:57.603071928 CET	15032	50000	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.603086948 CET	15032	50000	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.603132010 CET	50000	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:57.603760004 CET	50000	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:57.605592012 CET	50001	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:57.633557081 CET	15032	50000	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.883418083 CET	15032	50000	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.916114092 CET	15032	50000	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.918338060 CET	15032	50001	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:57.918418884 CET	50001	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:57.949709892 CET	50001	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:58.185571909 CET	50001	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:58.231293917 CET	15032	50001	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:58.231477976 CET	15032	50001	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:58.231679916 CET	50001	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:58.232445002 CET	50001	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:58.234431028 CET	50002	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:58.262353897 CET	15032	50001	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:58.498348951 CET	15032	50001	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:58.544326067 CET	15032	50001	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:58.547153950 CET	15032	50002	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:58.547231913 CET	50002	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:58.795614958 CET	50002	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:58.860182047 CET	15032	50002	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:58.860199928 CET	15032	50002	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:58.860240936 CET	50002	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:58.860254049 CET	50002	15032	192.168.2.4	3.6.115.64
Feb 9, 2024 22:15:59.108311892 CET	15032	50002	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:59.173826933 CET	15032	50002	3.6.115.64	192.168.2.4
Feb 9, 2024 22:15:59.173840046 CET	15032	50002	3.6.115.64	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 9, 2024 22:12:04.427783966 CET	58943	53	192.168.2.4	1.1.1.1
Feb 9, 2024 22:12:04.549186945 CET	53	58943	1.1.1.1	192.168.2.4
Feb 9, 2024 22:13:04.663635969 CET	62337	53	192.168.2.4	1.1.1.1
Feb 9, 2024 22:13:04.784725904 CET	53	62337	1.1.1.1	192.168.2.4
Feb 9, 2024 22:14:04.429121971 CET	62784	53	192.168.2.4	1.1.1.1
Feb 9, 2024 22:14:04.550024986 CET	53	62784	1.1.1.1	192.168.2.4
Feb 9, 2024 22:15:05.719211102 CET	64295	53	192.168.2.4	1.1.1.1
Feb 9, 2024 22:15:05.853503942 CET	53	64295	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 9, 2024 22:12:04.427783966 CET	192.168.2.4	1.1.1.1	0xed3e	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false
Feb 9, 2024 22:13:04.663635969 CET	192.168.2.4	1.1.1.1	0x8a6b	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false
Feb 9, 2024 22:14:04.429121971 CET	192.168.2.4	1.1.1.1	0x3163	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false
Feb 9, 2024 22:15:05.719211102 CET	192.168.2.4	1.1.1.1	0x64dd	Standard query (0)	0.tcp.in.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Feb 9, 2024 22:12:04.549186945 CET	1.1.1.1	192.168.2.4	0xed3e	No error (0)	0.tcp.in.ngrok.io	3.6.115.64	A (IP address)	IN (0x0001)	false
Feb 9, 2024 22:13:04.784725904 CET	1.1.1.1	192.168.2.4	0x8a6b	No error (0)	0.tcp.in.ngrok.io	3.6.122.107	A (IP address)	IN (0x0001)	false
Feb 9, 2024 22:14:04.550024986 CET	1.1.1.1	192.168.2.4	0x3163	No error (0)	0.tcp.in.ngrok.io	3.6.98.232	A (IP address)	IN (0x0001)	false
Feb 9, 2024 22:15:05.853503942 CET	1.1.1.1	192.168.2.4	0x64dd	No error (0)	0.tcp.in.ngrok.io	3.6.115.64	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	22:11:53
Start date:	09/02/2024
Path:	C:\Users\user\Desktop\ae6T8jJueq.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\ae6T8jJueq.exe
Imagebase:	0x110000
File size:	134'656 bytes
MD5 hash:	3F3186F4BE8DF39294C1A53F1CD22214
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1628881868.0000000000112000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.2%
Total number of Nodes:	142
Total number of Limit Nodes:	5

Executed Functions

Function 0491199A Relevance: 1.9, Strings: 1, Instructions: 692
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

2, xrefs: 04911A8F

Memory Dump Source

Source File: 00000000.00000002.4067618358.0000000004910000.00000040.00000800.00020000.00000000.sdmp, Offset: 04910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4910000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: a13e264c07ed2f6ae7b34c35c26d7ab83a164ec9963e3111ed1dc51a092b7814
Instruction ID: 9645679f35830d24abb30ac33a45ad1fa066c437b3a5d502281d776fe30ecda3
Opcode Fuzzy Hash: a13e264c07ed2f6ae7b34c35c26d7ab83a164ec9963e3111ed1dc51a092b7814
Instruction Fuzzy Hash: 3F526A34A01208DFDB14EB74E951BAE77B2FF89308F208469E506A77A8DB35AD45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04AF24C7 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 04AF2547

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: d274d86bd91baf131149de6183cfc0d2f208b16662e394d0c42b03ada5b4f564
Instruction ID: 7fb8a9fbcdc0d9ed94a5c4a57024dd110b855157782b591fc6b06ccbec7f65ce
Opcode Fuzzy Hash: d274d86bd91baf131149de6183cfc0d2f208b16662e394d0c42b03ada5b4f564
Instruction Fuzzy Hash: 50219F765097C09FDB228F25DC44B52BFB4AF06310F0884DAE9858B563D275A918CB62

Uniqueness

Uniqueness Score: -1.00%

Function 04AF24FE Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 04AF2547

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: be80b5d2da160c02d83a825bf7ded63073c61a5a2f422a2d3da11b48e0982d7c
Instruction ID: c968f9b7896e079e0a39af375c20625dca340c1cb389550d589970535a20a52c
Opcode Fuzzy Hash: be80b5d2da160c02d83a825bf7ded63073c61a5a2f422a2d3da11b48e0982d7c
Instruction Fuzzy Hash: C51173725002409FDB20CF55DC84B56FBE4EF08220F08C4AAEE45CB651D376F518DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 00A2A0D5

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 88fc09e649a9ffca87b8acbf7d1f853563cfcbf610ea237b1288938c8f5942dd
Instruction ID: 378f8d2d32df2ee97bd0b745ad22c23a372b34c18943155ff9a5b9c5c56a5f1d
Opcode Fuzzy Hash: 88fc09e649a9ffca87b8acbf7d1f853563cfcbf610ea237b1288938c8f5942dd
Instruction Fuzzy Hash: F201B1715042409FDB20CF59E884B65FBE4EF14324F08C4AADD498BA52D375E458CF62

Uniqueness

Uniqueness Score: -1.00%

Function 049113A0 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 049113C7

Memory Dump Source

Source File: 00000000.00000002.4067618358.0000000004910000.00000040.00000800.00020000.00000000.sdmp, Offset: 04910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4910000_ae6T8jJueq.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8d4e9187a3ca57d901e67a21a2121b2d9244337c6aca77f7f5a7d791bdafe09f
Instruction ID: 7ca9c0612b035003313e91ec3ead21332bc9c71191752b61f941b14dcfee149b
Opcode Fuzzy Hash: 8d4e9187a3ca57d901e67a21a2121b2d9244337c6aca77f7f5a7d791bdafe09f
Instruction Fuzzy Hash: D441B131B012048FCB04EF78C9855ADB7F6EF88218B148079D909DB3A9DB38DD46CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 04911391 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 049113C7

Memory Dump Source

Source File: 00000000.00000002.4067618358.0000000004910000.00000040.00000800.00020000.00000000.sdmp, Offset: 04910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4910000_ae6T8jJueq.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 89e4eec026b0646a94f85487a385a86b81f78f9961c6607a8c1dda4a712d823b
Instruction ID: 0deba8e4ac1b71ef342360018f1ef5654f3a15e2ff60b27ae2733ebe92f5bfc7
Opcode Fuzzy Hash: 89e4eec026b0646a94f85487a385a86b81f78f9961c6607a8c1dda4a712d823b
Instruction Fuzzy Hash: 1941A231A012049FCB14DF78C98959DB7F6EF88304B148079D909DB7AAEB38DD85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B6E2 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00A2B7A1

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b113f799d23fbee1dd100fe4575303b75f742893921531b8b5628f481828a759
Instruction ID: ab1554003c6f442f723b1ca7d68040832eef3d08cad015bebf9bdb8b187e2c87
Opcode Fuzzy Hash: b113f799d23fbee1dd100fe4575303b75f742893921531b8b5628f481828a759
Instruction Fuzzy Hash: 1431D6B15053806FE712CF25DC40BA2BFF8EF46314F08489AE985CB652D375A909D771

Uniqueness

Uniqueness Score: -1.00%

Function 04AF1FCD Relevance: 1.6, APIs: 1, Instructions: 102
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 04AF2099

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 86499aa982df17db7787b23d2153df397b1fb58bcf5f2ca5fa8f61966a286df7
Instruction ID: 68b3b07f0c46bd7ac460d861fc918a6b9e834b764c3e23d80d8e3657618c00a6
Opcode Fuzzy Hash: 86499aa982df17db7787b23d2153df397b1fb58bcf5f2ca5fa8f61966a286df7
Instruction Fuzzy Hash: 8A318FB2504344AFE7228F65CC44FA7BBFCEF05214F08859AF945CB652E365E948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A2BC4F Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 00A2BD16

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 737e42b800135b832123c268b0a086c2891461f06e412d76158f78cfd671f1dc
Instruction ID: e0cfdcb8de4c94b85b5d67b4145b6eb5b6b76765a71318aff9cd761544cb2312
Opcode Fuzzy Hash: 737e42b800135b832123c268b0a086c2891461f06e412d76158f78cfd671f1dc
Instruction Fuzzy Hash: 3B319C6510E7C06FD3138B258C61A61BFB4EF47610F0E85CBE8C48F6A3D6696909D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A7C7 Relevance: 1.6, APIs: 1, Instructions: 95
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 00A2A879

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 45d5d487ffa02c39887a7576b2ea4bccf00e0ccccc00e05d5c861eff57204d31
Instruction ID: b3c771d7842d5db8420dc6303d83a334bdba0219e14341c317c7c9a0fa909dc8
Opcode Fuzzy Hash: 45d5d487ffa02c39887a7576b2ea4bccf00e0ccccc00e05d5c861eff57204d31
Instruction Fuzzy Hash: FD31B6B64083846FE7228B55DC44FA7BFBCEF16314F09849AE984CB653D264A90DC771

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0AE8 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 04AF0BAF

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: f0050bb363d65d437b18d32a229a54af6d5c5ac91d328da8501e4b61db9c2c40
Instruction ID: 8dcfac775d68184558719ce877db48dd59fd50911cab754bb5cde787bd7fb5fc
Opcode Fuzzy Hash: f0050bb363d65d437b18d32a229a54af6d5c5ac91d328da8501e4b61db9c2c40
Instruction Fuzzy Hash: 3331B3B1504340AFE721CB51DC84FA6FBACEB44314F04849AFA459B582D374A948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 04AF09E0 Relevance: 1.6, APIs: 1, Instructions: 89
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessTimes.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF0A7D

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 3b3598b74a42afe944ea78cd66f4a5b720c2ca7c1277e97da72dddebd634a517
Instruction ID: 171371a594675127b30feeaedb609557a6c522ac4003a5acab5ed0c6161b09f7
Opcode Fuzzy Hash: 3b3598b74a42afe944ea78cd66f4a5b720c2ca7c1277e97da72dddebd634a517
Instruction Fuzzy Hash: D931E5B24093806FE7128F61DC44B96BFB8EF06324F09849AF984CF193D264A509CB75

Uniqueness

Uniqueness Score: -1.00%

Function 04AF02DC Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 04AF0373

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 9660c7151c7cb78da609185d1dd3d3c745848b8757503f46b917464873b93388
Instruction ID: 68824427ae7e8d0944babdd8ccd709e492b2bd28d2cfdc346fbc3520bc80487f
Opcode Fuzzy Hash: 9660c7151c7cb78da609185d1dd3d3c745848b8757503f46b917464873b93388
Instruction Fuzzy Hash: FA316171508384AFE721CF65DC45FA7BBE8EF45224F08849AF984DB652D364A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00A2A6B9

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: b90cccc96698ea8276d2fbbbc7fa32c05caf7b83b2f3660e3eadf1d131bc32cc
Instruction ID: fa3b20a411ddaf2191425b53aaa4c68b090f0b0eebb161d283c8ceb3f8c309a2
Opcode Fuzzy Hash: b90cccc96698ea8276d2fbbbc7fa32c05caf7b83b2f3660e3eadf1d131bc32cc
Instruction Fuzzy Hash: 2A31B5B55093805FE711CB25DC45B96FFF8EF06310F08849AE944CB692D375A909C766

Uniqueness

Uniqueness Score: -1.00%

Function 04AF1FFE Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 04AF2099

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 75d3059f297f2b1095fa203d700db6b9def2a2d65815bac4621e400be8f3075b
Instruction ID: ad50be812d152e3e2b625d62da54ba151f8ea7824d43f3849173571901711c1e
Opcode Fuzzy Hash: 75d3059f297f2b1095fa203d700db6b9def2a2d65815bac4621e400be8f3075b
Instruction Fuzzy Hash: 06217E72500204AFEB21CF55CC44FABFBECEF08614F08859AFE45C6651E765F948CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A8C1 Relevance: 1.6, APIs: 1, Instructions: 86
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 00A2A97D

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 40836c97915db79bfafed5038992e38c4b42a715e92a7c39b7101ad992b39701
Instruction ID: 793fd9299ce13c261ce929c4f6fdc18cf111de1c739701ff6e2073fb400bdaad
Opcode Fuzzy Hash: 40836c97915db79bfafed5038992e38c4b42a715e92a7c39b7101ad992b39701
Instruction Fuzzy Hash: 513108710053806FEB228F61DC44FA2FFB8EF06314F08849EE9858B552D275A54CCB65

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A361 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 00A2A40C

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 31f94f0131a68d0e94a43818e2a62c645099c40a0385ef6a4b7fbe75136112e8
Instruction ID: 7155f124441c1f760745d0882903dc41565abea419e4790713b62064907b0b4e
Opcode Fuzzy Hash: 31f94f0131a68d0e94a43818e2a62c645099c40a0385ef6a4b7fbe75136112e8
Instruction Fuzzy Hash: FD3181B5508780AFD722CF15DC84F96BBF8EF06310F08849AE945CB292D364E949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0B0A Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 04AF0BAF

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 6b7f88c0de182653d0171df707542111be48f5d84715693423483743734ada25
Instruction ID: d4f4edd3e1b9a4b7c7536a076ad45e8a003448d7b50b2ca8191be1e8bf997d28
Opcode Fuzzy Hash: 6b7f88c0de182653d0171df707542111be48f5d84715693423483743734ada25
Instruction Fuzzy Hash: A121D1B1500200AEEB20DF61CC84FAAF7ACEF44314F14885AFE49DA681E7B4B548CB71

Uniqueness

Uniqueness Score: -1.00%

Function 04AF29C2 Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.KERNELBASE(?,00000E24,?,?), ref: 04AF2A6E

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 04ff74721ba1cbbf6c380934138d41ca0a614a270617b6bb761adb0591eca1db
Instruction ID: 476810344dfeb77e733640e321a1dc612272b24f5959711d71b9bfab1cd474c2
Opcode Fuzzy Hash: 04ff74721ba1cbbf6c380934138d41ca0a614a270617b6bb761adb0591eca1db
Instruction Fuzzy Hash: 2731936100D3C06FD3138B218C65A62BFB4DF87610F1A80CBD884CB6A3D225A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0E5C Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 04AF0F02

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: a3f271a5d3eb19f3c576d17b26d571ba5f989dd1a8245fa25ebfc6b8023bacb6
Instruction ID: 1ca0c1d83a3ed91c4b7db9800da3563c8352e8b1934f65a09b8bccf2ee914474
Opcode Fuzzy Hash: a3f271a5d3eb19f3c576d17b26d571ba5f989dd1a8245fa25ebfc6b8023bacb6
Instruction Fuzzy Hash: 5C31917150D3C06FD3128B258C55B66BFB8EF47610F0980DBE884DF693D225A948C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 04AF2271 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 04AF2300

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: deff58d4af988f72895ff9793cdff3904b3ff150b5b53c1a3806ff04b9870b63
Instruction ID: 1be4843e476053dd170ecd4b6bc5c0d423967fb615fcb8b94a80da9db8b68e9f
Opcode Fuzzy Hash: deff58d4af988f72895ff9793cdff3904b3ff150b5b53c1a3806ff04b9870b63
Instruction Fuzzy Hash: AC217E755093809FDB22CF65DC44B92BFF8EF06314F0884DAE984CF162D265E948DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B7F8 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 00A2B88D

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d7a7010ff79ad26bd46e7f49ba8cc091e61febae482cde848b8be4c81934b104
Instruction ID: fa2103848eaaf99fca05f2340f6e10e8569267e9469bb6b2535a9f2140840389
Opcode Fuzzy Hash: d7a7010ff79ad26bd46e7f49ba8cc091e61febae482cde848b8be4c81934b104
Instruction Fuzzy Hash: BE21F2B54093C06FE7128B25DC85BA6BFACEF47724F0980D6E9848B293D264A90DC775

Uniqueness

Uniqueness Score: -1.00%

Function 04AF2649 Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF26D0

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 4fc30e4ac850dde9fdf2ecc6babd2f2ba09d63fc9b88768f2ca578bc99e2df5a
Instruction ID: e22b9b4d5ddac6c151e5971290065ea6c62a8abedffa03ded5fb0601b8204b0f
Opcode Fuzzy Hash: 4fc30e4ac850dde9fdf2ecc6babd2f2ba09d63fc9b88768f2ca578bc99e2df5a
Instruction Fuzzy Hash: 9D21C1B25093806FE712CB25DC44B96BFA8EF02224F0884EBF944CF292D264A908C771

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0492 Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 04AF0526

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: c80f7a5081d0eb4ff4288a6664901d1297b21496479ff26f65e490cdd447cffd
Instruction ID: f570eb7ce5269a68689375e01dab2de3f5d2d5690e4fd7f64c77f0a439dfe143
Opcode Fuzzy Hash: c80f7a5081d0eb4ff4288a6664901d1297b21496479ff26f65e490cdd447cffd
Instruction Fuzzy Hash: AF218DB1409380AFE722CF55DC44F96FBF8EF0A224F04849AE9858B652D375B548CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 00A2A4F8

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: e03ddb7d1f402cba51dda426d05d4d79bd559dfa74c39bfbdc8d3efbb06beaa0
Instruction ID: d6c3444371465954fe0a5c02a64dd3e8e0d930da8dc26b0c13d1f38ee01fa65a
Opcode Fuzzy Hash: e03ddb7d1f402cba51dda426d05d4d79bd559dfa74c39bfbdc8d3efbb06beaa0
Instruction Fuzzy Hash: 062192B65043806FD7228F15DC44FA7BFB8EF46224F08849AE945CB652D364E948C772

Uniqueness

Uniqueness Score: -1.00%

Function 00A2BD42 Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00A2BDCE

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 85604de6da1c307e56a313a91078d8643aeb172f2be042703835cc3f955282b0
Instruction ID: 6471f50625cd11a2b10ae9de0c9679828ce38ce4ce742f6d2e0d82c58d537174
Opcode Fuzzy Hash: 85604de6da1c307e56a313a91078d8643aeb172f2be042703835cc3f955282b0
Instruction Fuzzy Hash: 0C2191B1405380AFD721CF55DC45F96FFB8EF05320F04849EE9858B652D375A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0302 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 04AF0373

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 2c75f48c3b03c0b3824d674c8ae93a6d9ff1bec0ca57fa9c0a34dfdef292c482
Instruction ID: 1ebda9b5a0c391ae95afcb1faa2d3ba60265ab05b249242f4e02501468d24024
Opcode Fuzzy Hash: 2c75f48c3b03c0b3824d674c8ae93a6d9ff1bec0ca57fa9c0a34dfdef292c482
Instruction Fuzzy Hash: F421C272604244AFEB20DF65DC44FAAFBECEF04214F08846AFA44CB642E374E5088A71

Uniqueness

Uniqueness Score: -1.00%

Function 04AF2340 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 04AF23C6

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 14f99e04904c4899694a34a53862b723eecef52babeb0730fe05e6bf05b386d1
Instruction ID: 773752168a8fb2e2b6635f70cbaa56670bb85265f82d006edafebfb2ced52276
Opcode Fuzzy Hash: 14f99e04904c4899694a34a53862b723eecef52babeb0730fe05e6bf05b386d1
Instruction Fuzzy Hash: DA2181B25093805FD712CF25DC54B52BFA8AF46224F0884DAE948CB253D266A849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B722 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00A2B7A1

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f327155dfaa2d05973a8594699e539e1838301591da7d56c9e87c6f203c6d8bc
Instruction ID: fb3fda76a1cec4e64e41c217d069c246d3a32642b2f71ee777b08a8da4979a77
Opcode Fuzzy Hash: f327155dfaa2d05973a8594699e539e1838301591da7d56c9e87c6f203c6d8bc
Instruction Fuzzy Hash: 4221B271501240AFEB20CF25DD84F66FBE8EF44314F088469E9458B751D375E808CB71

Uniqueness

Uniqueness Score: -1.00%

Function 04AF01F6 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF0288

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bd256377e82380ca1d095f3609d6c3af3e813cb73a077d777a3a94ac45bf2891
Instruction ID: 10cb032d5c490ecf3207aa9d23deaae1e70b367280e988485a35b17c393d6c36
Opcode Fuzzy Hash: bd256377e82380ca1d095f3609d6c3af3e813cb73a077d777a3a94ac45bf2891
Instruction Fuzzy Hash: BE2190B5508380AFD721CF51DC44FA6BBF8EF05210F08849AFA45CB652D364E548CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A7FA Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 00A2A879

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: c387dbc20ce5ca638f883d391768c29cf7935ba46eb2b5a84c134640426f246c
Instruction ID: b5d1bbbc9df44d7c7cf89e5933114061fd7d4c6d2e4e614a049d9129e5c22b63
Opcode Fuzzy Hash: c387dbc20ce5ca638f883d391768c29cf7935ba46eb2b5a84c134640426f246c
Instruction Fuzzy Hash: 88219FB2500204AFE7219F55DC44FABFBACEF14324F04846AED45CA651D774E90D8AB6

Uniqueness

Uniqueness Score: -1.00%

Function 04AF2733 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF27AF

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: fae415bc442c46f58a91d7d27e1b5ad13c832ef8876be9c30d09588fac447e62
Instruction ID: a77f9cd4e1a581993fbd290cdac3873b698a630370c1e66e097060ad1ec290d1
Opcode Fuzzy Hash: fae415bc442c46f58a91d7d27e1b5ad13c832ef8876be9c30d09588fac447e62
Instruction Fuzzy Hash: AB21D7B15083806FD711CF55DC44FA6BFA8EF45224F08849BF944CB152D364A508CB75

Uniqueness

Uniqueness Score: -1.00%

Function 04AF2817 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF2893

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: fae415bc442c46f58a91d7d27e1b5ad13c832ef8876be9c30d09588fac447e62
Instruction ID: 0c167124a24ef214099413499f0cc4dd3b70031fdaf10aa1ad1333d946a8b6b5
Opcode Fuzzy Hash: fae415bc442c46f58a91d7d27e1b5ad13c832ef8876be9c30d09588fac447e62
Instruction Fuzzy Hash: A021D4B15093806FD712CF51DC44FAABFA8EF46224F08849BF944DB292D364A948CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0729 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF07AC

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 632326c3513fc7426b746dbeeaf790328484abab61ce50d0cc5c78c82c138a6b
Instruction ID: 97871f2fd3a0ff889c88a6028bff8f5554546f9f7efe7e491b1f41c403c36d10
Opcode Fuzzy Hash: 632326c3513fc7426b746dbeeaf790328484abab61ce50d0cc5c78c82c138a6b
Instruction Fuzzy Hash: 0E2195B14097806FD712CB51DC44B96FFB8EF46224F0884DBE944DB252D368A548CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00A2A6B9

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: cc439a7b6c1cc7780b2c718534b24d35d1187a3b49e57793c3bc43049beb339a
Instruction ID: cd792363e3ca669886dc45aeb25a84bc4f1ba77e0049a3cfe5cd1be5f1889ed1
Opcode Fuzzy Hash: cc439a7b6c1cc7780b2c718534b24d35d1187a3b49e57793c3bc43049beb339a
Instruction Fuzzy Hash: C721A4B16042409FE710DF29DD85BA6FBE8EF14324F08846AED44CBB41D775E909CA76

Uniqueness

Uniqueness Score: -1.00%

Function 00A2BADA Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 00A2BB59

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4a229bc97bef80130af85c3aa8e7b3fba33db02723c2241588062f90358293d3
Instruction ID: 353e43bcea4d293276400b0370e7b237c5c7a84ce9c34e26d3c5c4f8ec51d827
Opcode Fuzzy Hash: 4a229bc97bef80130af85c3aa8e7b3fba33db02723c2241588062f90358293d3
Instruction Fuzzy Hash: CF21A471405380AFDB22CF55DC44F97FFB8EF45324F08849AE9449B552D365A508CB75

Uniqueness

Uniqueness Score: -1.00%

Function 04AF21AB Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF2227

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: e74a0f83b94962ecc0995876d338df63eea06930e8c66f3cae53e9ab2bbdca5e
Instruction ID: 8eba55010c5ac1e94ac09df7dc8a36662658bc862f54f2a80ebe533c66696f84
Opcode Fuzzy Hash: e74a0f83b94962ecc0995876d338df63eea06930e8c66f3cae53e9ab2bbdca5e
Instruction Fuzzy Hash: 8E21A1B24093806FD722CF51DC84FA6BFA8EF45224F08849AFA449F652D365A508C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 00A2A40C

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0431369d1b702d752e006ca168854eaa035241e48a76d600f2af3750fcc40362
Instruction ID: 2e8041374530c08352d38cc22d1ec755987d18dce3fd0d69fc7f4645b794bd34
Opcode Fuzzy Hash: 0431369d1b702d752e006ca168854eaa035241e48a76d600f2af3750fcc40362
Instruction Fuzzy Hash: 9D21D2B5600200AFE720CF19DC84FA6F7ECEF14720F08846AED45CB651D3A0E808CA72

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0CBA Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 04AF0D36

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 6a21a667635cbc83a4570d1d42e216db27d428e9fb6c031e260fb97b73f8b99c
Instruction ID: ca65c39a6a77eea8feb27295a31cd341bb321e69fb7e6837963759dc785aa134
Opcode Fuzzy Hash: 6a21a667635cbc83a4570d1d42e216db27d428e9fb6c031e260fb97b73f8b99c
Instruction Fuzzy Hash: 86219F71508384AFDB228F51DC44B62FFF8EF06320F0884DAEA858B563D375A818DB61

Uniqueness

Uniqueness Score: -1.00%

Function 04AF04B2 Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 04AF0526

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 510a6a71b64993aa96bac4179e49b8529a9d09a2eba688812d90339e143f612b
Instruction ID: 0462950f7f8acbbe700c0bf7491fbadbb62ac22eadf16ebdd50aa900948a375f
Opcode Fuzzy Hash: 510a6a71b64993aa96bac4179e49b8529a9d09a2eba688812d90339e143f612b
Instruction Fuzzy Hash: 5A21A1B1504240AFE721CF55DC85FAAFBE8EF09224F048459FA458B652D3B5F508CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2BD62 Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00A2BDCE

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 8292d50ec64bc0eed4fbbcbcd25a11186d707a45b38dd4051c5e1476b3982cf8
Instruction ID: cfae89dde2dca77c56d7b2882ac8f8652b84fedd6d2579f85a2fed7b3a7966eb
Opcode Fuzzy Hash: 8292d50ec64bc0eed4fbbcbcd25a11186d707a45b38dd4051c5e1476b3982cf8
Instruction Fuzzy Hash: 7821D1B1500240AFEB21CF55DC45FAAFBE8EF08324F14886EEA458B651D375A808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 04AF111E Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 04AF11A7

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d298881640af2e9a932ba8841d22f28275de5a5c2448305ef3f3f71d209a7461
Instruction ID: 18c260a54d475344e940168ce00a73241166ee379f91160bc1269dff2421d9d8
Opcode Fuzzy Hash: d298881640af2e9a932ba8841d22f28275de5a5c2448305ef3f3f71d209a7461
Instruction Fuzzy Hash: FF110A714053806FE721CB11DC85FA6FFB8DF45320F04849AFE448B692D2A4B948C765

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A902 Relevance: 1.6, APIs: 1, Instructions: 66windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,00000E24), ref: 00A2A97D

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 8d3566ef7d2d4357605cb53c35a8cb732423fd23c3dbec0ba38fe2c6b661ae67
Instruction ID: 5130b5eaf9118b374a2db6ba761ae127cb9fbc0dac03a07482f94d32358c9e11
Opcode Fuzzy Hash: 8d3566ef7d2d4357605cb53c35a8cb732423fd23c3dbec0ba38fe2c6b661ae67
Instruction Fuzzy Hash: 05210671500200AFEB318F56DC40FA6FBB8EF04314F18886AFE458AA51D375B548CB76

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A710 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00A2A780

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1a64ccbad899470ae92ef2f5534b00bb6eadd22f79c187a47c48018aa27fa717
Instruction ID: d6bf277eac89309454d4d848790f9860bde750fabffda80041a066a1737c612e
Opcode Fuzzy Hash: 1a64ccbad899470ae92ef2f5534b00bb6eadd22f79c187a47c48018aa27fa717
Instruction Fuzzy Hash: DC2190B59083809FD7118F15ED85B52BFA8EF02324F0884AAED458B653D375A909DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0216 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF0288

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: cd653bd36ade9030bcdc2655c3a470f5ed8bf1f3076bfdd0e4e509d1c1d49447
Instruction ID: 717cf6c50f9a1eb35c7ff841a9479d70830a99bdf1289998d858b39989c1b8ef
Opcode Fuzzy Hash: cd653bd36ade9030bcdc2655c3a470f5ed8bf1f3076bfdd0e4e509d1c1d49447
Instruction Fuzzy Hash: 0611ACB6504240AFEB21CF91DC84FA6FBECEF04624F08845AFE458B652D760F548CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 00A2A4F8

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: dfecd063f1415f5fc1e6a64f4020f525dd405c1d369bf1918a837afc3a8b00e3
Instruction ID: 74993bf2983354fbc7c8e8dcc4eb09b897e8da387f0124267648b293f2a25ba0
Opcode Fuzzy Hash: dfecd063f1415f5fc1e6a64f4020f525dd405c1d369bf1918a837afc3a8b00e3
Instruction Fuzzy Hash: BE11D6B5500640AFE721CF15DC44F67FBECEF14714F04846AED45CA651D360E848CA72

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0A1E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF0A7D

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 7c059dfef559a0c1c73b8f7d2628ff0aa3751c5df4f8178a0ad3607f8af74ab8
Instruction ID: b3112e70ae0b43ba598055b23dd69ea4382dc6a167f154d6732475ce1cfd7037
Opcode Fuzzy Hash: 7c059dfef559a0c1c73b8f7d2628ff0aa3751c5df4f8178a0ad3607f8af74ab8
Instruction Fuzzy Hash: 1711D371604240AFEB21CF55DC44BAAFBE8EF04224F08845AFE45CA651D374E508CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 04AF283A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF2893

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 74f7bf4a4222db0e55ed02093af295e707e816fac81e8c884be741e0f9c88c69
Instruction ID: 2ccfbddd67d57b2aebc377a58e67d3c095936edd22895ef5d083ba7fadc420e1
Opcode Fuzzy Hash: 74f7bf4a4222db0e55ed02093af295e707e816fac81e8c884be741e0f9c88c69
Instruction Fuzzy Hash: A411C4B2500240AFEB11CF55DC44BAAF7E8EF04324F1884AAFE05CB641D775A548CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 04AF2756 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF27AF

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 74f7bf4a4222db0e55ed02093af295e707e816fac81e8c884be741e0f9c88c69
Instruction ID: c1be254aa44ab8fb6fa8a054f77728a7d87fa812617798731305dea6dbf24034
Opcode Fuzzy Hash: 74f7bf4a4222db0e55ed02093af295e707e816fac81e8c884be741e0f9c88c69
Instruction Fuzzy Hash: A81104B2500240AFEB10CF55DC44FAAFBA8EF04224F0884AAFE44CB641D375A508CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B16F Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E24,?,?), ref: 00A2B1F2

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: dec9af0be1e0ad5032a7d91ec362372168280a079d8b24cb7dc54bc775818c3e
Instruction ID: 71573ba3c180b701682d94a7f3dc5163d9cca0a7bfdaca1e51588a17960357bd
Opcode Fuzzy Hash: dec9af0be1e0ad5032a7d91ec362372168280a079d8b24cb7dc54bc775818c3e
Instruction Fuzzy Hash: A3113B715047806FD311CB16CC41F72FFB8EF86620F09809AED4887A42D230B915CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 04AF267A Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF26D0

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: bc4d147cecb099dbf40ef5caa15522db844887b256982dea41f58edc221cadf2
Instruction ID: e555036d605bdab19ae1ed89d384c963624bb07c4f791e7291a6c4ee15e2ea04
Opcode Fuzzy Hash: bc4d147cecb099dbf40ef5caa15522db844887b256982dea41f58edc221cadf2
Instruction Fuzzy Hash: A011E7B2500240AFEB10CF55DC44BAAF7ACDF44224F0484AAFE04CB641E775A508CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 00A2AD07 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A2AD72

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2f39bac06952a6799f6c5736f04a009fb2276c932bf99704399dcf7a7adfb13a
Instruction ID: 5b8fecdf326843c2821366c99d5e285d0fa2d515251acc3cbad2fa4f071a23c7
Opcode Fuzzy Hash: 2f39bac06952a6799f6c5736f04a009fb2276c932bf99704399dcf7a7adfb13a
Instruction Fuzzy Hash: 11118471409380AFDB228F55DC44B62FFF4EF4A320F0884DAED858B563D275A919DB62

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0152 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000E24,?,?), ref: 04AF01CE

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 9a7d170a438257fd1734f1f1c06672e8754dec241a84f52273e7b6f3f0dc8290
Instruction ID: a4697aecf988ee5596956533ea6f54bc965de50ee66b25485d3e429f5f07e2e9
Opcode Fuzzy Hash: 9a7d170a438257fd1734f1f1c06672e8754dec241a84f52273e7b6f3f0dc8290
Instruction Fuzzy Hash: 7411E7B1504380BFD3118B16DC41F36FFB8EFC6620F05819AEC4497682D721B915CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A2BAFA Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 00A2BB59

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d58e635c5562971bc95932e7b5bb74d9057c9bcb4bd923514bd2c13995319249
Instruction ID: c4734abc8ee0f7d43a43e121ea2d8f8433e0557335493abdb863144986a45139
Opcode Fuzzy Hash: d58e635c5562971bc95932e7b5bb74d9057c9bcb4bd923514bd2c13995319249
Instruction Fuzzy Hash: 2911E372500340AFEB21CF55DC84FAAFBE8EF04324F18846AEE458B655D375A508CBB6

Uniqueness

Uniqueness Score: -1.00%

Function 04AF21CE Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF2227

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: a750e41dff3854de6913b9acb1d641f35d1272b66c5f38217057d5ccbe95d3ad
Instruction ID: 77f88937c9558541b3de4e7097b9c3a9e4fd54c5c6f8fa44e7219aec46d21ac6
Opcode Fuzzy Hash: a750e41dff3854de6913b9acb1d641f35d1272b66c5f38217057d5ccbe95d3ad
Instruction Fuzzy Hash: 0A11E772504240AFE721CF91DC84FAAFBA8EF04724F048496FE049F641D375A508CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0756 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 04AF07AC

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 162729f73173c8a195507c7cab39c884173b74d3f99db6c916e8ca8bfc52f5c4
Instruction ID: c73077c5ec3d73cc99eaa3a20066a9e2664c7adbec4ffbc1d460b35391016719
Opcode Fuzzy Hash: 162729f73173c8a195507c7cab39c884173b74d3f99db6c916e8ca8bfc52f5c4
Instruction Fuzzy Hash: 4D11C2B1504640AFEB11CF51DC84FAAFBE8EF44624F188496FE449B642E374A508CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 04AF113E Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 04AF11A7

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 33069f4b5094a86f73cb35e650fc96d4c29b7a2c719f6e4382587f59d672a17a
Instruction ID: 68fc6b59080cae0398689be7325a1f239b13f445a2eedba4837c1b592aa3a90e
Opcode Fuzzy Hash: 33069f4b5094a86f73cb35e650fc96d4c29b7a2c719f6e4382587f59d672a17a
Instruction Fuzzy Hash: 6911E971505240AEE720CB12DC81FA6F7A8DF04724F148499FE054AA81D3B4B948CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A2D2 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00A2A330

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 12ea212a60c85435ba8865e448872d2e8c2b03d48985683f814d2e4bdc095dcc
Instruction ID: 070e6d3defe6cc6d86d7efb22c647bb15d799d31de57333bc630199130cf8f85
Opcode Fuzzy Hash: 12ea212a60c85435ba8865e448872d2e8c2b03d48985683f814d2e4bdc095dcc
Instruction Fuzzy Hash: B6118F754093C0AFDB128B19DC54A62BFB4DF57224F0880DBED848F263D265A908DB62

Uniqueness

Uniqueness Score: -1.00%

Function 04AF22AA Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 04AF2300

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: c811618b2823e1dfc14cd63bfa7103fa88f883bb58a4bb3d4e82bbb85c49390e
Instruction ID: bdc6ac858ac08b8132b0cafe4e596cb2cd0d14dc6d88ddae53110f44e106b3f3
Opcode Fuzzy Hash: c811618b2823e1dfc14cd63bfa7103fa88f883bb58a4bb3d4e82bbb85c49390e
Instruction Fuzzy Hash: D21130766002409FDB20CF95DC84B96F7E8EF04710F0885AAEE49CB651D375E948DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A2AEA3 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 00A2AF04

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 1c6c896d739055cdafda51d56d926f496b9f255b6cda398d9842f6528c7913ef
Instruction ID: aceeb4114e9edade616268b9ef783150adfebb86537a03df4913450f698b374f
Opcode Fuzzy Hash: 1c6c896d739055cdafda51d56d926f496b9f255b6cda398d9842f6528c7913ef
Instruction Fuzzy Hash: 90116DB14493C09FDB12CB15DC84B52BFB4EF46224F0884DBED858B293D279A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,?), ref: 00A2A0D5

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 466d2c241c64d1cae303a8cd4778cd7948a113c9059dfe5eba11f8723eda0038
Instruction ID: eaefdf2ba06de8b04405374029d4726d7d66fc7f69e9b3ddc5e71c7288e4c00e
Opcode Fuzzy Hash: 466d2c241c64d1cae303a8cd4778cd7948a113c9059dfe5eba11f8723eda0038
Instruction Fuzzy Hash: 6C119175509380AFDB22CF15DC44B52FFB4EF56324F0884DAED848B552D275A918CB62

Uniqueness

Uniqueness Score: -1.00%

Function 04AF237E Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 04AF23C6

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: dd813b3acad2e1732605fe6a74c5941a32bfe7b57cb37190728f8e47310a2a15
Instruction ID: 9b7a8f022c7bcabfd6a22a7c4b23221d251abc0335b6d830768b782864c10bee
Opcode Fuzzy Hash: dd813b3acad2e1732605fe6a74c5941a32bfe7b57cb37190728f8e47310a2a15
Instruction Fuzzy Hash: DC1152B26042409FEB10CF55DC85796FBE8EF04220F0885AAEE49CB655D775E548CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B83A Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,F00BDAF4,00000000,00000000,00000000,00000000), ref: 00A2B88D

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 57c3dcd61a67f65dd2e67c1402feb3ad6a8f553cdbb08a508c446c758c078cdc
Instruction ID: 6a4b4a8e821346093f92186bfcddb08a2a54017dc324cdeffcb0b36f9e4405e7
Opcode Fuzzy Hash: 57c3dcd61a67f65dd2e67c1402feb3ad6a8f553cdbb08a508c446c758c078cdc
Instruction Fuzzy Hash: 4401D6B5504244AFE710CB15EC84BAAF7ACDF04724F18C0A6EE088B741D774A94CCAB5

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0CEA Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 04AF0D36

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 63cd09ead7ee0fa858540227d2cefea68be260b83fcc8feb0286c55c09cbd621
Instruction ID: e7493146b001c660b66ff46f8b0cc192c7e7ec4e23494557a0e7bba2ff2b8d00
Opcode Fuzzy Hash: 63cd09ead7ee0fa858540227d2cefea68be260b83fcc8feb0286c55c09cbd621
Instruction Fuzzy Hash: 10117C715046449FDB20CF95DC84B66FBE4EF08320F0888AAEE858B622D375F418DB61

Uniqueness

Uniqueness Score: -1.00%

Function 04AF0EB2 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 04AF0F02

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 94462fbbbd920324b6da21e1371a4d6d8e9bb4902dc3145beaab6b24abe333ef
Instruction ID: b796d44d95290784790e8304f89fa031fd12fae2e3965e46ff43d7aceef4ed6f
Opcode Fuzzy Hash: 94462fbbbd920324b6da21e1371a4d6d8e9bb4902dc3145beaab6b24abe333ef
Instruction Fuzzy Hash: 0101B171600600ABD310DF16CC86B76FBE8EB88A20F14855AED089BB41D771B915CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00A2AD2E Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A2AD72

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 65194fda0ca6164cce13628b25f9eff2c6465a946a2fd92403d90134bc467632
Instruction ID: 155cc282305643a660e1edf71a43464b5c8cca8dcdb941d2689de14052399d77
Opcode Fuzzy Hash: 65194fda0ca6164cce13628b25f9eff2c6465a946a2fd92403d90134bc467632
Instruction Fuzzy Hash: 9801C4314002409FDB20CF55E944B56FFF0EF08320F08C8AADE498AA52C375E418DF62

Uniqueness

Uniqueness Score: -1.00%

Function 04AF2A1E Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.KERNELBASE(?,00000E24,?,?), ref: 04AF2A6E

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 227986f776a139e9963578cc5a89489161f402454314f7ede4f2f14d35418b91
Instruction ID: a980188ead6f5f066da29855a5c6bf27284f716107cf2c65299a8c1179f228db
Opcode Fuzzy Hash: 227986f776a139e9963578cc5a89489161f402454314f7ede4f2f14d35418b91
Instruction Fuzzy Hash: 2B01AD71600600ABD310DF16CC86B66FBE8FB88A20F14815AED089BB41E771F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 04AF017E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000E24,?,?), ref: 04AF01CE

Memory Dump Source

Source File: 00000000.00000002.4067738423.0000000004AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4af0000_ae6T8jJueq.jbxd

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 2aae5d85955e8d598cac250dc0533d14130fa6322878dc03dcdd661363ab2aec
Instruction ID: f328d819bb4c19b897c848ce0ba600ba0b260c404a14e0d165f3d5a14a731725
Opcode Fuzzy Hash: 2aae5d85955e8d598cac250dc0533d14130fa6322878dc03dcdd661363ab2aec
Instruction Fuzzy Hash: B701D171600600ABD310DF16CC86B76FBE8FB88A20F14815AED089BB41E771F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00A2B1A2 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

MkParseDisplayName.OLE32(?,00000E24,?,?), ref: 00A2B1F2

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: DisplayNameParse
String ID:
API String ID: 3580041360-0
Opcode ID: dfca2e1cf44617a503214c7681ed8e7fcfce709f8fd05848b833aa9540d72fa9
Instruction ID: a5cd5e25df95acff1b43f676bd7f47c57448c6027c57bf15db59fb0bd41e2a5a
Opcode Fuzzy Hash: dfca2e1cf44617a503214c7681ed8e7fcfce709f8fd05848b833aa9540d72fa9
Instruction Fuzzy Hash: B601AD71600600ABD310DF16CC86B66FBE8FB88A20F14815AED089BB41E771F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00A2BCC6 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 00A2BD16

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 3fb91970e45f2de3368486aa05d2c3b31d7f92e84cc8fcb1a2c8a25a1003bb45
Instruction ID: fa8d9b8f8baa05f6df39ba44fc535b548051aa037ba0725667ebe74b8d8ea0ba
Opcode Fuzzy Hash: 3fb91970e45f2de3368486aa05d2c3b31d7f92e84cc8fcb1a2c8a25a1003bb45
Instruction Fuzzy Hash: 6201A271500600ABD310DF16CC86B66FBE8FB88A20F14815AED089BB41D771F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00A2A780

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 1b3b67cee47e641afda8420c2feaa058d0545921f30a41c7cf4b0e525d088b62
Instruction ID: dbbc903afc16b46d279a73b852c1c759aa25459f177565327849aafc5c4e8bee
Opcode Fuzzy Hash: 1b3b67cee47e641afda8420c2feaa058d0545921f30a41c7cf4b0e525d088b62
Instruction Fuzzy Hash: 5401DF719042408FEB10CF1AE984766FBE4DF04320F08C4ABDD49CB752D375E808CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A2AED2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

closesocket.WS2_32(?), ref: 00A2AF04

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 67548e8bbee9842490fef89f5c4efa7c477b919c8efa84278f7f392e1823aa21
Instruction ID: a550b1e2ee66643545c7380a2c7e1b608b93a415db7061f9d0a770f5176de514
Opcode Fuzzy Hash: 67548e8bbee9842490fef89f5c4efa7c477b919c8efa84278f7f392e1823aa21
Instruction Fuzzy Hash: 5701D6719052809FDB10CF19E984765FBE4DF14320F08C4AADD498F756D379A548CE62

Uniqueness

Uniqueness Score: -1.00%

Function 00A2A2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00A2A330

Memory Dump Source

Source File: 00000000.00000002.4066094006.0000000000A2A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A2A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a2a000_ae6T8jJueq.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 281bf829956c9c1d5a4aadf09a42b9987131dad31e1914ebee1f26479d06b09a
Instruction ID: 05ff464525b64e9ae53724a76a0e8597a5671c86b9e16a931ab27597d2980a5b
Opcode Fuzzy Hash: 281bf829956c9c1d5a4aadf09a42b9987131dad31e1914ebee1f26479d06b09a
Instruction Fuzzy Hash: 6FF08C798046409FDB10CF0AE888765FBA4EF14324F08C0AADD594F752D3B5A848CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A807AC Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066290445.0000000000A80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b431c3de2d3f49ae4e35be4da143ff296e4100e80c54bdc31781180faa17f3
Instruction ID: 5c79ba625162c7f8148ffe80b65d9345a1c4f00a2d4c105a7debc7b9ee8336c2
Opcode Fuzzy Hash: d1b431c3de2d3f49ae4e35be4da143ff296e4100e80c54bdc31781180faa17f3
Instruction Fuzzy Hash: 9721EB3150E3C08FC7179B20D950B51BFB1AF57704F2985EBD4858B5A3C23A985ADBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04EF1C60 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4067808035.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f574b6627bf07838b10183ac4502ae0509eb20aadbed901d29b249a4f896988d
Instruction ID: e4bc1c01cac4caae363cfd69f1444df2e51e6cb34a54bcae682b14e4ac783e35
Opcode Fuzzy Hash: f574b6627bf07838b10183ac4502ae0509eb20aadbed901d29b249a4f896988d
Instruction Fuzzy Hash: F611CCB5908341AFD340CF19D880A5BFBE8FB88664F04895EF998D7311D371E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A80814 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066290445.0000000000A80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1fd03e8a82ef1efc1ba618d8a756c1536907a27486697e0a68eeda7ac15712c
Instruction ID: 461b445dabcba0cfb515e709d594c40d6b098de80656ecf4d238891a1838b918
Opcode Fuzzy Hash: a1fd03e8a82ef1efc1ba618d8a756c1536907a27486697e0a68eeda7ac15712c
Instruction Fuzzy Hash: 1711B431604284DFD755DB10D540F15BBA5AB98708F28C9ACE8491BB53C777D88ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A807E4 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066290445.0000000000A80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a96741f758ada949865b16fb5353b8d4f015a0f9de10067d81b6d6bde1787e44
Instruction ID: 527927441f546e754de7318bc87cd1162a39858805fdb077ae858b2d8cf8acc2
Opcode Fuzzy Hash: a96741f758ada949865b16fb5353b8d4f015a0f9de10067d81b6d6bde1787e44
Instruction Fuzzy Hash: 4221607150D3C09FDB13CB10C990B55BFB1AB96318F1985DED4895B6A3C33A884BDB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A3ADEC Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066143139.0000000000A3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a3a000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd14170f1710819d29068c4df2fb8599c261db3d228d8af54b408c9c808b015a
Instruction ID: a32c1993601807bb211574fbf6aa7d2c0baefa92ee7ceb7c0d9d2ebc6cd62444
Opcode Fuzzy Hash: fd14170f1710819d29068c4df2fb8599c261db3d228d8af54b408c9c808b015a
Instruction Fuzzy Hash: 0C11FAB5908341AFD350CF09DC80E5BFBE8EB88660F04891EF95997711D271E9088FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00A805DF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066290445.0000000000A80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e0f567b86cacabfce574e80fe14ec09e48050c03078008c8b5e12fc2eeb283c
Instruction ID: 2f652d3c53728668cae8cbeae213e492507a8571bafd6d0802e511167cbd09d8
Opcode Fuzzy Hash: 7e0f567b86cacabfce574e80fe14ec09e48050c03078008c8b5e12fc2eeb283c
Instruction Fuzzy Hash: 9C0162B65097806FD7118B06EC44863FFA8EF86620709849BFC9987652D265B809CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00A808D0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066290445.0000000000A80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43aaed4043c3387615be297ac1b4a5030632dbf7968a31c5258d734846b9b1e2
Instruction ID: baca64d36f9badc9cc3d1ad570cf7d8dca6e30e696c1879197a712ad01438c4b
Opcode Fuzzy Hash: 43aaed4043c3387615be297ac1b4a5030632dbf7968a31c5258d734846b9b1e2
Instruction Fuzzy Hash: 90F0F635108644DFC716CB00D980F15FBA2EB89718F24CAA9E9491BA62C737A856DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00A80606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066290445.0000000000A80000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a80000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7d79b089b35980971d493563215ab71ebb60261ffc555abf98acc1e4aaeb7d9
Instruction ID: 1abae7c744efd516d325e9068b1697d5c9f0c725fad02eebcd9e80ded2b1a350
Opcode Fuzzy Hash: d7d79b089b35980971d493563215ab71ebb60261ffc555abf98acc1e4aaeb7d9
Instruction Fuzzy Hash: 30E092B66046404B9750CF0AFC81452F7D8EB84630B18C07FDC1D8B701E676B508CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 04EF1CCB Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4067808035.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d5b10ac4455cc38d97b884e1dd72964310b42d7087f3e2daee4d422d83ca486
Instruction ID: a7f81605e2b9d0b5689c3204596b9e980f53fdd0feedd6438efa759c339ce99c
Opcode Fuzzy Hash: 9d5b10ac4455cc38d97b884e1dd72964310b42d7087f3e2daee4d422d83ca486
Instruction Fuzzy Hash: 01E0D8F254030467D7108F06DC45F52FB9CDB44931F08C467EE185B741E1B1B51489E1

Uniqueness

Uniqueness Score: -1.00%

Function 04EF1577 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4067808035.0000000004EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ef0000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9925dbdcf0aad7e0da6da24405e680074edab4e18df70667c8e5bfbdff7ee0
Instruction ID: 5047b2c8bba7fec58878559640792b2d4ec2f1218b33e1912ec4c1fb4c6c67c9
Opcode Fuzzy Hash: 2a9925dbdcf0aad7e0da6da24405e680074edab4e18df70667c8e5bfbdff7ee0
Instruction Fuzzy Hash: ABE0D8B650020467D210DF06EC45F53FB9CDB40930F08C457EE085B741E1B2B514C9E1

Uniqueness

Uniqueness Score: -1.00%

Function 00A3AE3B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066143139.0000000000A3A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A3A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a3a000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7256a1a5ee70f2a15dda788b697f93369a1471d3be3420bea18a4cb7114221
Instruction ID: 4a2f0cc432fe20fc5ac172c87a7e70c135fc7556e53ada8ba90082a8b4dfa92c
Opcode Fuzzy Hash: 8e7256a1a5ee70f2a15dda788b697f93369a1471d3be3420bea18a4cb7114221
Instruction Fuzzy Hash: D2E0D8B254420467D2108F06DC45F52FBACDB40931F08C557EE095B742E1B1B50489F1

Uniqueness

Uniqueness Score: -1.00%

Function 00A223F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066079697.0000000000A22000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a22000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ab5b688a60c1bd1a20852d10f9ef8c44ee10fbff5ba144044c2b5b6048dc27
Instruction ID: 7cffff1f714f075d7e032c5f5b68b412e4ec81df19f15dbb2b50784142dff596
Opcode Fuzzy Hash: 02ab5b688a60c1bd1a20852d10f9ef8c44ee10fbff5ba144044c2b5b6048dc27
Instruction Fuzzy Hash: 02D02E392406D05FD312AB1CE1A4B8937D4AB41704F0A00FAAC008B763C768D880C600

Uniqueness

Uniqueness Score: -1.00%

Function 00A223BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4066079697.0000000000A22000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A22000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a22000_ae6T8jJueq.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a3902ac17ec37976e5d1d8246f909f405289dcaa56df06bfed3ad95c248c30d
Instruction ID: 3f2d476cad17daace76b3fa3066cef4cca8e35155bfa63c820c74279f3c28150
Opcode Fuzzy Hash: 6a3902ac17ec37976e5d1d8246f909f405289dcaa56df06bfed3ad95c248c30d
Instruction Fuzzy Hash: B3D05E342002814BD71ADB0CE2D4F5937D4AF44714F0644F8AC108F762C7A8D8C0DA00

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ae6T8jJueq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
ae6T8jJueq.exe

Function 0491199A Relevance: 1.9, Strings: 1, Instructions: 692
COMMON

Function 049113A0 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 04911391 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Function 00A2B6E2 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 04AF1FCD Relevance: 1.6, APIs: 1, Instructions: 102
registryCOMMON

Function 00A2BC4F Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 00A2A7C7 Relevance: 1.6, APIs: 1, Instructions: 95
registryCOMMON

Function 04AF0AE8 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 04AF09E0 Relevance: 1.6, APIs: 1, Instructions: 89
timeCOMMON

Function 04AF02DC Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 00A2A612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Function 00A2A8C1 Relevance: 1.6, APIs: 1, Instructions: 86
windowtimeCOMMON