Edit tour

Windows Analysis Report
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Overview

General Information

Sample name:	592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe
Analysis ID:	1412298
MD5:	760c3907f64ea9fb60e13d4847c083a6
SHA1:	fa3e06c44cd48a02acb359d9e6adee88a2cd561d
SHA256:	592cdad0a5b0ae90e0c812aecb2677096af06cf941ce20a5a556ad837fc2bf90
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

Disables zone checking for all users

Machine Learning detection for dropped file

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe (PID: 5100 cmdline: "C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe" MD5: 760C3907F64EA9FB60E13D4847C083A6)

system.exe (PID: 7392 cmdline: "C:\Users\user\AppData\Local\Temp\system.exe" MD5: 760C3907F64EA9FB60E13D4847C083A6)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Install Dir": "TEMP", "Install Name": "system.exe", "Startup": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "dikorolevstvonahui", "Version": "Njrat 0.7 Golden By Hassan Amiri", "Network Seprator": "|Hassan|", "Mutex": "Windows Update", "Install Flag": "True"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x9402:$a2: SEE_MASK_NOZONECHECKS 0x9212:$a3: Download ERROR 0x962a:$a4: cmd.exe /c ping 0 -n 2 & del "
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x962a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94b8:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x90ac:$x3: www.upload.ee/image/ 0x9104:$x3: www.upload.ee/image/ 0x9160:$x3: www.upload.ee/image/ 0x8daa:$s1: winmgmts:\\.\root\SecurityCenter2 0x94a0:$s2: /Server.exe 0x9234:$s3: Executed As 0x724d:$s5: Stub.exe 0x9212:$s6: Download ERROR 0x8ed0:$s7: shutdown -r -t 00 0x8d6c:$s8: Select * From AntiVirusProduct
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x9402:$reg: SEE_MASK_NOZONECHECKS 0x91ee:$msg: Execute ERROR 0x924e:$msg: Execute ERROR 0x962a:$ping: cmd.exe /c ping 0 -n 2 & del

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\system.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
C:\Users\user\AppData\Local\Temp\system.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x9402:$a2: SEE_MASK_NOZONECHECKS 0x9212:$a3: Download ERROR 0x962a:$a4: cmd.exe /c ping 0 -n 2 & del "
C:\Users\user\AppData\Local\Temp\system.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x962a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94b8:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x90ac:$x3: www.upload.ee/image/ 0x9104:$x3: www.upload.ee/image/ 0x9160:$x3: www.upload.ee/image/ 0x8daa:$s1: winmgmts:\\.\root\SecurityCenter2 0x94a0:$s2: /Server.exe 0x9234:$s3: Executed As 0x724d:$s5: Stub.exe 0x9212:$s6: Download ERROR 0x8ed0:$s7: shutdown -r -t 00 0x8d6c:$s8: Select * From AntiVirusProduct
C:\Users\user\AppData\Local\Temp\system.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x9402:$reg: SEE_MASK_NOZONECHECKS 0x91ee:$msg: Execute ERROR 0x924e:$msg: Execute ERROR 0x962a:$ping: cmd.exe /c ping 0 -n 2 & del

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7abd:$a1: get_Registry 0x9202:$a2: SEE_MASK_NOZONECHECKS 0x9012:$a3: Download ERROR 0x942a:$a4: cmd.exe /c ping 0 -n 2 & del "
00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x9202:$reg: SEE_MASK_NOZONECHECKS 0x8fee:$msg: Execute ERROR 0x904e:$msg: Execute ERROR 0x942a:$ping: cmd.exe /c ping 0 -n 2 & del
00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x21cb9:$a1: get_Registry 0x98c:$a2: SEE_MASK_NOZONECHECKS 0x233fe:$a2: SEE_MASK_NOZONECHECKS 0x2320e:$a3: Download ERROR 0x23626:$a4: cmd.exe /c ping 0 -n 2 & del "
00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x98c:$reg: SEE_MASK_NOZONECHECKS 0x233fe:$reg: SEE_MASK_NOZONECHECKS 0x231ea:$msg: Execute ERROR 0x2324a:$msg: Execute ERROR 0x23626:$ping: cmd.exe /c ping 0 -n 2 & del
Process Memory Space: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe PID: 5100	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x9402:$a2: SEE_MASK_NOZONECHECKS 0x9212:$a3: Download ERROR 0x962a:$a4: cmd.exe /c ping 0 -n 2 & del "
1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x962a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94b8:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x90ac:$x3: www.upload.ee/image/ 0x9104:$x3: www.upload.ee/image/ 0x9160:$x3: www.upload.ee/image/ 0x8daa:$s1: winmgmts:\\.\root\SecurityCenter2 0x94a0:$s2: /Server.exe 0x9234:$s3: Executed As 0x724d:$s5: Stub.exe 0x9212:$s6: Download ERROR 0x8ed0:$s7: shutdown -r -t 00 0x8d6c:$s8: Select * From AntiVirusProduct
1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x9402:$reg: SEE_MASK_NOZONECHECKS 0x91ee:$msg: Execute ERROR 0x924e:$msg: Execute ERROR 0x962a:$ping: cmd.exe /c ping 0 -n 2 & del
1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x9402:$a2: SEE_MASK_NOZONECHECKS 0x9212:$a3: Download ERROR 0x962a:$a4: cmd.exe /c ping 0 -n 2 & del "
1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x962a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x94b8:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x90ac:$x3: www.upload.ee/image/ 0x9104:$x3: www.upload.ee/image/ 0x9160:$x3: www.upload.ee/image/ 0x8daa:$s1: winmgmts:\\.\root\SecurityCenter2 0x94a0:$s2: /Server.exe 0x9234:$s3: Executed As 0x724d:$s5: Stub.exe 0x9212:$s6: Download ERROR 0x8ed0:$s7: shutdown -r -t 00 0x8d6c:$s8: Select * From AntiVirusProduct
1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x9402:$reg: SEE_MASK_NOZONECHECKS 0x91ee:$msg: Execute ERROR 0x924e:$msg: Execute ERROR 0x962a:$ping: cmd.exe /c ping 0 -n 2 & del
1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x5ebd:$a1: get_Registry 0x7602:$a2: SEE_MASK_NOZONECHECKS 0x7412:$a3: Download ERROR 0x782a:$a4: cmd.exe /c ping 0 -n 2 & del "
1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x782a:$x1: cmd.exe /c ping 0 -n 2 & del " 0x76b8:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x72ac:$x3: www.upload.ee/image/ 0x7304:$x3: www.upload.ee/image/ 0x7360:$x3: www.upload.ee/image/ 0x6faa:$s1: winmgmts:\\.\root\SecurityCenter2 0x76a0:$s2: /Server.exe 0x7434:$s3: Executed As 0x544d:$s5: Stub.exe 0x7412:$s6: Download ERROR 0x70d0:$s7: shutdown -r -t 00 0x6f6c:$s8: Select * From AntiVirusProduct
1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x7602:$reg: SEE_MASK_NOZONECHECKS 0x73ee:$msg: Execute ERROR 0x744e:$msg: Execute ERROR 0x782a:$ping: cmd.exe /c ping 0 -n 2 & del
Click to see the 7 entries

Snort Signatures

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:17.117522
SID:	2033132
Source Port:	49861
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:17.826009
SID:	2033132
Source Port:	49863
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:17.476282
SID:	2033132
Source Port:	49862
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:27.899372
SID:	2033132
Source Port:	50058
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:34.678105
SID:	2033132
Source Port:	49759
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:27.566069
SID:	2033132
Source Port:	50057
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:28.245313
SID:	2033132
Source Port:	50059
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:34.195221
SID:	2033132
Source Port:	49758
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:58.903009
SID:	2033132
Source Port:	49979
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:57.865801
SID:	2033132
Source Port:	49976
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:58.254077
SID:	2033132
Source Port:	49977
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:58.553691
SID:	2033132
Source Port:	49978
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:36.241858
SID:	2033132
Source Port:	49762
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:28.973268
SID:	2033132
Source Port:	50061
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:30.046081
SID:	2033132
Source Port:	49751
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:30.732966
SID:	2033132
Source Port:	49752
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:56.485509
SID:	2033132
Source Port:	49972
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:56.878214
SID:	2033132
Source Port:	49973
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:02.149082
SID:	2033132
Source Port:	49983
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:02.364485
SID:	2033132
Source Port:	49984
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:25.260873
SID:	2033132
Source Port:	50050
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:25.531231
SID:	2033132
Source Port:	50051
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:28.630865
SID:	2033132
Source Port:	50060
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:29.276158
SID:	2033132
Source Port:	50062
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:29.374696
SID:	2033132
Source Port:	49750
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:31.884427
SID:	2033132
Source Port:	49754
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:56.145691
SID:	2033132
Source Port:	49971
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:57.549082
SID:	2033132
Source Port:	49975
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:59.936048
SID:	2033132
Source Port:	49982
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:35.696647
SID:	2033132
Source Port:	49761
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:37.609991
SID:	2033132
Source Port:	49765
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:03.102543
SID:	2033132
Source Port:	49986
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:38.185703
SID:	2033132
Source Port:	49766
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:32.461422
SID:	2033132
Source Port:	49755
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:33.031971
SID:	2033132
Source Port:	49756
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:26.897863
SID:	2033132
Source Port:	50055
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:30.676925
SID:	2033132
Source Port:	50066
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:35.196346
SID:	2033132
Source Port:	49760
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:38.997242
SID:	2033132
Source Port:	49768
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:19.929064
SID:	2033132
Source Port:	49869
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:27.221021
SID:	2033132
Source Port:	50056
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:30.992917
SID:	2033132
Source Port:	50067
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:33.599697
SID:	2033132
Source Port:	49757
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:57.188989
SID:	2033132
Source Port:	49974
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:02.699409
SID:	2033132
Source Port:	49985
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:38.618293
SID:	2033132
Source Port:	49767
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:19.154412
SID:	2033132
Source Port:	49867
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:19.490074
SID:	2033132
Source Port:	49868
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:18.142756
SID:	2033132
Source Port:	49864
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:26.549705
SID:	2033132
Source Port:	50054
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:30.312006
SID:	2033132
Source Port:	50065
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:59.242532
SID:	2033132
Source Port:	49980
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:30.070607
SID:	2033132
Source Port:	50064
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:18.500137
SID:	2033132
Source Port:	49865
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:37.145985
SID:	2033132
Source Port:	49764
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:29.568248
SID:	2033132
Source Port:	50063
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:31.288802
SID:	2033132
Source Port:	49753
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:55.824936
SID:	2033132
Source Port:	49970
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:59.554934
SID:	2033132
Source Port:	49981
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:25.876753
SID:	2033132
Source Port:	50052
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:26.226942
SID:	2033132
Source Port:	50053
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:36.708505
SID:	2033132
Source Port:	49763
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:18.837574
SID:	2033132
Source Port:	49866
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:16.737525
SID:	2033132
Source Port:	49860
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:28.679104
SID:	2033132
Source Port:	49749
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:31.699520
SID:	2033132
Source Port:	50069
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:24.138268
SID:	2033132
Source Port:	50047
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:24.505930
SID:	2033132
Source Port:	50048
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:31.389803
SID:	2033132
Source Port:	50068
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:27.273761
SID:	2033132
Source Port:	49747
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:28.024320
SID:	2033132
Source Port:	49748
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:41.351980
SID:	2033132
Source Port:	49769
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:24.816974
SID:	2033132
Source Port:	50049
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:16.817845
SID:	2033132
Source Port:	50026
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:16.488629
SID:	2033132
Source Port:	50025
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:15.740414
SID:	2033132
Source Port:	50023
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:15.429587
SID:	2033132
Source Port:	50022
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:16.083968
SID:	2033132
Source Port:	50024
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:30.070894
SID:	2825563
Source Port:	50064
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:41.447377
SID:	2825563
Source Port:	49769
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:14.713390
SID:	2033132
Source Port:	50020
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:15.066883
SID:	2033132
Source Port:	50021
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:23.212192
SID:	2825563
Source Port:	50044
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:23.570737
SID:	2825563
Source Port:	50045
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:04.906053
SID:	2033132
Source Port:	50153
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:14.987532
SID:	2033132
Source Port:	49855
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:23.609925
SID:	2033132
Source Port:	49880
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:04.682670
SID:	2825563
Source Port:	50152
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:03.823872
SID:	2033132
Source Port:	50151
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:05.605615
SID:	2033132
Source Port:	50155
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:24.335536
SID:	2033132
Source Port:	49882
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:08.965711
SID:	2033132
Source Port:	50157
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:13.688476
SID:	2033132
Source Port:	49851
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:16.367321
SID:	2033132
Source Port:	49859
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:25.016109
SID:	2033132
Source Port:	49884
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:21.483338
SID:	2825563
Source Port:	50039
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:15.714036
SID:	2033132
Source Port:	49857
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:20.401477
SID:	2033132
Source Port:	50036
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:21.039914
SID:	2033132
Source Port:	50038
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:17.868211
SID:	2033132
Source Port:	49738
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:52.061648
SID:	2033132
Source Port:	49959
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:50.745637
SID:	2033132
Source Port:	49955
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:51.375402
SID:	2033132
Source Port:	49957
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:14.318067
SID:	2033132
Source Port:	49853
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:07.495588
SID:	2033132
Source Port:	49999
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:20.953562
SID:	2033132
Source Port:	49741
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:13.124179
SID:	2825563
Source Port:	50015
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:18.242899
SID:	2033132
Source Port:	50030
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:49.252527
SID:	2033132
Source Port:	49951
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:49.946431
SID:	2033132
Source Port:	49953
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:24.166404
SID:	2033132
Source Port:	49743
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:42.531478
SID:	2033132
Source Port:	49772
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:52.823289
SID:	2033132
Source Port:	49961
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:54.108362
SID:	2033132
Source Port:	49965
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:05.421447
SID:	2033132
Source Port:	49993
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:06.799684
SID:	2033132
Source Port:	49997
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:38.027431
SID:	2033132
Source Port:	50083
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:44.320991
SID:	2033132
Source Port:	49776
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:46.950087
SID:	2033132
Source Port:	49783
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:48.452993
SID:	2033132
Source Port:	49787
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:14.022066
SID:	2033132
Source Port:	50018
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:34.255529
SID:	2033132
Source Port:	50072
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:25.695398
SID:	2033132
Source Port:	49745
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:19.679647
SID:	2033132
Source Port:	50034
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:23.570446
SID:	2033132
Source Port:	50045
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:41.667433
SID:	2033132
Source Port:	49770
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:53.457472
SID:	2033132
Source Port:	49963
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:06.164535
SID:	2033132
Source Port:	49995
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:37.290745
SID:	2033132
Source Port:	50081
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:40.058010
SID:	2033132
Source Port:	50089
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:45.026473
SID:	2033132
Source Port:	49778
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:46.184171
SID:	2033132
Source Port:	49781
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:49.210510
SID:	2033132
Source Port:	49789
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:32.078539
SID:	2033132
Source Port:	50070
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:36.283454
SID:	2033132
Source Port:	50078
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:22.955429
SID:	2033132
Source Port:	49878
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:26.355630
SID:	2033132
Source Port:	49888
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:18.525315
SID:	2825563
Source Port:	49701
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:25.684915
SID:	2033132
Source Port:	49886
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:39.322113
SID:	2033132
Source Port:	50087
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:35.565237
SID:	2033132
Source Port:	50076
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:22.757702
SID:	2033132
Source Port:	50043
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:18.911540
SID:	2033132
Source Port:	50032
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:22.286075
SID:	2033132
Source Port:	49876
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:22.068097
SID:	2033132
Source Port:	50041
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:43.355119
SID:	2033132
Source Port:	49774
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:04.724439
SID:	2033132
Source Port:	49991
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:38.668891
SID:	2033132
Source Port:	50085
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:47.770524
SID:	2033132
Source Port:	49785
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:34.893199
SID:	2033132
Source Port:	50074
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:20.191576
SID:	2033132
Source Port:	49870
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:27.372641
SID:	2033132
Source Port:	49891
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:28.113362
SID:	2033132
Source Port:	49893
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:21.533524
SID:	2033132
Source Port:	49874
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:30.192508
SID:	2033132
Source Port:	49895
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:20.872856
SID:	2033132
Source Port:	49872
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:48.265775
SID:	2033132
Source Port:	49948
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:55.464162
SID:	2033132
Source Port:	49969
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:46.839638
SID:	2033132
Source Port:	49944
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:47.560354
SID:	2033132
Source Port:	49946
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:10.710965
SID:	2825563
Source Port:	50008
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:54.802310
SID:	2033132
Source Port:	49967
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:03.714911
SID:	2033132
Source Port:	49988
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:13.408993
SID:	2033132
Source Port:	50016
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:02.149475
SID:	2825563
Source Port:	49983
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:33.989928
SID:	2825563
Source Port:	50071
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:12.641567
SID:	2033132
Source Port:	50014
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:11.957579
SID:	2033132
Source Port:	50012
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:58.509910
SID:	2033132
Source Port:	50138
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:19.410807
SID:	2825563
Source Port:	50033
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:09.131705
SID:	2033132
Source Port:	49838
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:11.318619
SID:	2033132
Source Port:	50010
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:16.179572
SID:	2033132
Source Port:	49700
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:56.737400
SID:	2033132
Source Port:	50133
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:55.676309
SID:	2033132
Source Port:	50130
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:57.055951
SID:	2033132
Source Port:	50134
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:58.081582
SID:	2033132
Source Port:	50137
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:47.150084
SID:	2825563
Source Port:	49719
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:08.094835
SID:	2033132
Source Port:	49835
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:44.805687
SID:	2825563
Source Port:	49718
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:08.433986
SID:	2033132
Source Port:	49836
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:44.807856
SID:	2033132
Source Port:	49938
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:42.325724
SID:	2033132
Source Port:	49717
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:43.408751
SID:	2033132
Source Port:	49934
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:44.690326
SID:	2033132
Source Port:	49718
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:43.906228
SID:	2033132
Source Port:	49935
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:06.694097
SID:	2033132
Source Port:	49831
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:07.024885
SID:	2033132
Source Port:	49832
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:09.563054
SID:	2033132
Source Port:	50005
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:51.071864
SID:	2033132
Source Port:	49794
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:45.829349
SID:	2033132
Source Port:	49941
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:42.031827
SID:	2033132
Source Port:	49930
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:42.375764
SID:	2033132
Source Port:	49931
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:41.050882
SID:	2033132
Source Port:	50092
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:41.370552
SID:	2033132
Source Port:	50093
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:51.444410
SID:	2033132
Source Port:	49795
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:46.158434
SID:	2033132
Source Port:	49942
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:49.574734
SID:	2033132
Source Port:	49790
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:52.607560
SID:	2033132
Source Port:	49798
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:49.971132
SID:	2033132
Source Port:	49791
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:52.847810
SID:	2033132
Source Port:	49799
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:10.620546
SID:	2033132
Source Port:	50008
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:28.055645
SID:	2825563
Source Port:	49711
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:25.700334
SID:	2825563
Source Port:	49710
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:10.936184
SID:	2033132
Source Port:	50009
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:57.162038
SID:	2825563
Source Port:	49724
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:30.762953
SID:	2033132
Source Port:	49897
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:42.446680
SID:	2033132
Source Port:	50096
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:42.761045
SID:	2033132
Source Port:	50097
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:37.757732
SID:	2825563
Source Port:	49715
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:35.410672
SID:	2825563
Source Port:	49714
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:31.091041
SID:	2033132
Source Port:	49898
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:00.175279
SID:	2033132
Source Port:	50143
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:52.980610
SID:	2033132
Source Port:	50122
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:04.246563
SID:	2033132
Source Port:	49824
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:53.302160
SID:	2033132
Source Port:	50123
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:11.612348
SID:	2033132
Source Port:	49845
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:59.158456
SID:	2033132
Source Port:	50140
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:00.558132
SID:	2033132
Source Port:	50144
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:10.184683
SID:	2033132
Source Port:	49841
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:01.544030
SID:	2033132
Source Port:	50147
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:54.297538
SID:	2033132
Source Port:	50126
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:03.099045
SID:	2825563
Source Port:	49728
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:11.920634
SID:	2033132
Source Port:	49846
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:04.866700
SID:	2825563
Source Port:	49729
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:03.306679
SID:	2825563
Source Port:	49821
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:04.618497
SID:	2033132
Source Port:	49825
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:17.308189
SID:	2033132
Source Port:	50027
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:29.145241
SID:	2825563
Source Port:	49894
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:02.032446
SID:	2033132
Source Port:	49820
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:10.594812
SID:	2033132
Source Port:	49842
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:03.300697
SID:	2033132
Source Port:	49821
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:09.246598
SID:	2033132
Source Port:	50004
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:07.239430
SID:	2033132
Source Port:	49730
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:43.907101
SID:	2825563
Source Port:	49935
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:08.182517
SID:	2033132
Source Port:	50001
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:35.275798
SID:	2033132
Source Port:	49714
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:45.205863
SID:	2033132
Source Port:	49939
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:14.301539
SID:	2033132
Source Port:	49735
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:07.851633
SID:	2033132
Source Port:	50000
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:54.656700
SID:	2033132
Source Port:	50127
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:33.056000
SID:	2033132
Source Port:	49713
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:12.913874
SID:	2033132
Source Port:	49849
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:01.883405
SID:	2033132
Source Port:	50148
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:13.068943
SID:	2033132
Source Port:	49734
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:25.560735
SID:	2033132
Source Port:	49710
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:08.696255
SID:	2033132
Source Port:	49731
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:05.645733
SID:	2033132
Source Port:	49828
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:05.990658
SID:	2033132
Source Port:	49829
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:05.260617
SID:	2033132
Source Port:	50154
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:13.973934
SID:	2033132
Source Port:	49852
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:15.373515
SID:	2033132
Source Port:	49856
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:03.870282
SID:	2825563
Source Port:	50151
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:47.936901
SID:	2033132
Source Port:	50112
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:02.577310
SID:	2033132
Source Port:	50150
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:59.921446
SID:	2033132
Source Port:	49814
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:24.660853
SID:	2033132
Source Port:	49883
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:20.700902
SID:	2033132
Source Port:	50037
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:36.639914
SID:	2033132
Source Port:	50079
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:07.155628
SID:	2033132
Source Port:	49998
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:36.593716
SID:	2033132
Source Port:	49914
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:58.523247
SID:	2033132
Source Port:	49810
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:18.958943
SID:	2033132
Source Port:	49739
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:51.037561
SID:	2033132
Source Port:	49956
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:42.942790
SID:	2033132
Source Port:	49773
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:53.085925
SID:	2033132
Source Port:	49962
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:05.773004
SID:	2033132
Source Port:	49994
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:37.639802
SID:	2033132
Source Port:	50082
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:38.647767
SID:	2033132
Source Port:	49920
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:21.754924
SID:	2033132
Source Port:	50040
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:35.191934
SID:	2033132
Source Port:	49910
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:47.326374
SID:	2033132
Source Port:	49784
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:33.989433
SID:	2033132
Source Port:	50071
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:19.410307
SID:	2033132
Source Port:	50033
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:23.210607
SID:	2033132
Source Port:	50044
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:08.829127
SID:	2825563
Source Port:	49731
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:44.598423
SID:	2033132
Source Port:	49777
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:45.809585
SID:	2033132
Source Port:	49780
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:48.834753
SID:	2033132
Source Port:	49788
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:14.371676
SID:	2033132
Source Port:	50019
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:26.480864
SID:	2033132
Source Port:	49746
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:49.603125
SID:	2033132
Source Port:	49952
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:14.415433
SID:	2825563
Source Port:	49735
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:04.387917
SID:	2033132
Source Port:	49990
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:38.991310
SID:	2033132
Source Port:	50086
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:35.230175
SID:	2033132
Source Port:	50075
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:26.066166
SID:	2033132
Source Port:	49887
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:21.864563
SID:	2033132
Source Port:	49742
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:22.610550
SID:	2033132
Source Port:	49877
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:21.195129
SID:	2033132
Source Port:	49873
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:29.055491
SID:	2033132
Source Port:	49894
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:48.586731
SID:	2033132
Source Port:	49949
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:47.192044
SID:	2033132
Source Port:	49945
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:54.457512
SID:	2033132
Source Port:	49966
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:03.429780
SID:	2033132
Source Port:	49987
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:39.985886
SID:	2033132
Source Port:	49924
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:20.992587
SID:	2033132
Source Port:	49707
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:02.967182
SID:	2033132
Source Port:	49728
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:32.787020
SID:	2033132
Source Port:	49903
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:27.075718
SID:	2033132
Source Port:	49890
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:13.122999
SID:	2033132
Source Port:	50015
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:11.653303
SID:	2033132
Source Port:	50011
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:41.353373
SID:	2033132
Source Port:	49928
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:57.050561
SID:	2033132
Source Port:	49724
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:34.155007
SID:	2033132
Source Port:	49907
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:51.005354
SID:	2033132
Source Port:	50116
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:50.231857
SID:	2033132
Source Port:	49720
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:01.308038
SID:	2033132
Source Port:	49818
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:09.503893
SID:	2033132
Source Port:	49839
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:31.880164
SID:	2033132
Source Port:	49900
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:43.801622
SID:	2033132
Source Port:	50100
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:53.623386
SID:	2033132
Source Port:	49801
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:54.021314
SID:	2033132
Source Port:	49802
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:44.533283
SID:	2033132
Source Port:	50102
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:44.188697
SID:	2033132
Source Port:	50101
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:45.234989
SID:	2033132
Source Port:	50104
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:55.001791
SID:	2033132
Source Port:	49805
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:54.329759
SID:	2033132
Source Port:	49803
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:54.697470
SID:	2033132
Source Port:	49804
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:44.865613
SID:	2033132
Source Port:	50103
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:53.233467
SID:	2033132
Source Port:	49800
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:37.626450
SID:	2033132
Source Port:	49917
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:46.579513
SID:	2033132
Source Port:	50108
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:58.298564
SID:	2033132
Source Port:	49809
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:38.034611
SID:	2033132
Source Port:	49918
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:38.261902
SID:	2033132
Source Port:	49919
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:45.902723
SID:	2033132
Source Port:	50106
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:45.574906
SID:	2033132
Source Port:	50105
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:46.978913
SID:	2033132
Source Port:	50109
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:55.360543
SID:	2033132
Source Port:	49806
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:55.760587
SID:	2033132
Source Port:	49807
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:56.085479
SID:	2033132
Source Port:	49808
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:46.263484
SID:	2033132
Source Port:	50107
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:58.895532
SID:	2033132
Source Port:	49811
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:59.635836
SID:	2033132
Source Port:	49813
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:47.592990
SID:	2033132
Source Port:	50111
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:00.276611
SID:	2033132
Source Port:	49815
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:48.287349
SID:	2033132
Source Port:	50113
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:49.179070
SID:	2033132
Source Port:	50115
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:36.931019
SID:	2033132
Source Port:	49915
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:51.005813
SID:	2825563
Source Port:	50116
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:36.238337
SID:	2033132
Source Port:	49913
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:35.619599
SID:	2033132
Source Port:	49911
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:38.978275
SID:	2033132
Source Port:	49921
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:10.341652
SID:	2825563
Source Port:	49732
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:58.306823
SID:	2825563
Source Port:	49809
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:13.132924
SID:	2825563
Source Port:	49734
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:41.023051
SID:	2033132
Source Port:	49927
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:01.103231
SID:	2033132
Source Port:	49727
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:40.332237
SID:	2033132
Source Port:	49925
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:33.135084
SID:	2033132
Source Port:	49904
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:04.725475
SID:	2033132
Source Port:	49729
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:39.661338
SID:	2033132
Source Port:	49923
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:32.475848
SID:	2033132
Source Port:	49902
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:33.934293
SID:	2033132
Source Port:	49906
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:01.691543
SID:	2033132
Source Port:	49819
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:51.333936
SID:	2033132
Source Port:	50117
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:51.948321
SID:	2033132
Source Port:	50119
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:41.710293
SID:	2033132
Source Port:	49929
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:34.523482
SID:	2033132
Source Port:	49908
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:52.468002
SID:	2033132
Source Port:	49721
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:00.980673
SID:	2033132
Source Port:	49817
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:07.374557
SID:	2033132
Source Port:	49833
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:56.349798
SID:	2033132
Source Port:	50132
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:56.061355
SID:	2033132
Source Port:	50131
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:06.441491
SID:	2033132
Source Port:	49830
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:07.720986
SID:	2033132
Source Port:	49834
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:42.458544
SID:	2825563
Source Port:	49717
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:08.834909
SID:	2033132
Source Port:	49837
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:57.755247
SID:	2033132
Source Port:	50136
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:57.435101
SID:	2033132
Source Port:	50135
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:37.628520
SID:	2033132
Source Port:	49715
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:44.460402
SID:	2033132
Source Port:	49937
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:44.126675
SID:	2033132
Source Port:	49936
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:39.969990
SID:	2033132
Source Port:	49716
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:47.014622
SID:	2033132
Source Port:	49719
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:50.684829
SID:	2033132
Source Port:	49793
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:45.551011
SID:	2033132
Source Port:	49940
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:09.869043
SID:	2033132
Source Port:	50006
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:46.496883
SID:	2033132
Source Port:	49943
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:42.788234
SID:	2033132
Source Port:	49932
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:43.067446
SID:	2033132
Source Port:	49933
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:40.364442
SID:	2033132
Source Port:	50090
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:41.724346
SID:	2033132
Source Port:	50094
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:10.370327
SID:	2033132
Source Port:	50007
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:10.371418
SID:	2825563
Source Port:	50007
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:50.346470
SID:	2033132
Source Port:	49792
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:40.698176
SID:	2033132
Source Port:	50091
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:43.468630
SID:	2033132
Source Port:	50099
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:31.452419
SID:	2033132
Source Port:	49899
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:54.943025
SID:	2825563
Source Port:	49722
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:43.129601
SID:	2033132
Source Port:	50098
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:30.398570
SID:	2825563
Source Port:	49712
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:40.103102
SID:	2825563
Source Port:	49716
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:30.406758
SID:	2033132
Source Port:	49896
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:01.242069
SID:	2825563
Source Port:	49727
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:52.176986
SID:	2033132
Source Port:	49797
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:59.263951
SID:	2825563
Source Port:	49726
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:51.822453
SID:	2033132
Source Port:	49796
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:42.147885
SID:	2033132
Source Port:	50095
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:11.232381
SID:	2033132
Source Port:	49844
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:59.913896
SID:	2033132
Source Port:	50142
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:03.516594
SID:	2033132
Source Port:	49822
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:52.266879
SID:	2033132
Source Port:	50120
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:23.343782
SID:	2825563
Source Port:	49709
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:59.486563
SID:	2033132
Source Port:	50141
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:00.862524
SID:	2033132
Source Port:	50145
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:03.920651
SID:	2033132
Source Port:	49823
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:09.845798
SID:	2033132
Source Port:	49840
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:53.980414
SID:	2033132
Source Port:	50125
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:12.312713
SID:	2033132
Source Port:	49847
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:12.624731
SID:	2033132
Source Port:	49848
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:01.212369
SID:	2033132
Source Port:	50146
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:53.616001
SID:	2033132
Source Port:	50124
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:04.923867
SID:	2033132
Source Port:	49826
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:17.942826
SID:	2033132
Source Port:	50029
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:10.894124
SID:	2033132
Source Port:	49843
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:17.624774
SID:	2033132
Source Port:	50028
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:52.604025
SID:	2033132
Source Port:	50121
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:08.872270
SID:	2033132
Source Port:	50003
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:08.534243
SID:	2033132
Source Port:	50002
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:55.348053
SID:	2033132
Source Port:	50129
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:55.002794
SID:	2033132
Source Port:	50128
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:30.280883
SID:	2033132
Source Port:	49712
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:02.225126
SID:	2033132
Source Port:	50149
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:05.304929
SID:	2033132
Source Port:	49827
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:27.916037
SID:	2033132
Source Port:	49711
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:11.632034
SID:	2033132
Source Port:	49733
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:10.220692
SID:	2033132
Source Port:	49732
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:59.241663
SID:	2033132
Source Port:	49812
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:14.679889
SID:	2033132
Source Port:	49854
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:24.002154
SID:	2033132
Source Port:	49881
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:04.681635
SID:	2033132
Source Port:	50152
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:00.620156
SID:	2033132
Source Port:	49816
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:13.266494
SID:	2033132
Source Port:	49850
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:34:16.096153
SID:	2033132
Source Port:	49858
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:25.329687
SID:	2033132
Source Port:	49885
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:36:05.926777
SID:	2033132
Source Port:	50156
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:15.497642
SID:	2033132
Source Port:	49736
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:48.617566
SID:	2033132
Source Port:	50114
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:37.245206
SID:	2033132
Source Port:	49916
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:45.463655
SID:	2033132
Source Port:	49779
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:16.758650
SID:	2033132
Source Port:	49737
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:51.723576
SID:	2033132
Source Port:	49958
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:35.883636
SID:	2033132
Source Port:	49912
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:49.181009
SID:	2825563
Source Port:	50115
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:21.483122
SID:	2033132
Source Port:	50039
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:47.243495
SID:	2033132
Source Port:	50110
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:46.570418
SID:	2033132
Source Port:	49782
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:13.718956
SID:	2033132
Source Port:	50017
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:34.553614
SID:	2033132
Source Port:	50073
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:52.392438
SID:	2033132
Source Port:	49960
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:53.783365
SID:	2033132
Source Port:	49964
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:39.297153
SID:	2033132
Source Port:	49922
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:19.971213
SID:	2033132
Source Port:	49740
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:24.928789
SID:	2033132
Source Port:	49744
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:48.998960
SID:	2033132
Source Port:	49950
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:50.307672
SID:	2033132
Source Port:	49954
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:35.910741
SID:	2033132
Source Port:	50077
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:42.101778
SID:	2033132
Source Port:	49771
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:06.450352
SID:	2033132
Source Port:	49996
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:20.027267
SID:	2033132
Source Port:	50035
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:36.923458
SID:	2033132
Source Port:	50080
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:39.656033
SID:	2033132
Source Port:	50088
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:23.830195
SID:	2033132
Source Port:	50046
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:26.727559
SID:	2033132
Source Port:	49889
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:33:11.774779
SID:	2825563
Source Port:	49733
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:21.990200
SID:	2033132
Source Port:	49875
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:23.243718
SID:	2033132
Source Port:	49879
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:48.139468
SID:	2033132
Source Port:	49786
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:43.752379
SID:	2033132
Source Port:	49775
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:05.118997
SID:	2033132
Source Port:	49992
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:18.555049
SID:	2033132
Source Port:	50031
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:38.296846
SID:	2033132
Source Port:	50084
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:22.425212
SID:	2033132
Source Port:	50042
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:20.549165
SID:	2033132
Source Port:	49871
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:27.726262
SID:	2033132
Source Port:	49892
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:59.127550
SID:	2033132
Source Port:	49726
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:33.476243
SID:	2033132
Source Port:	49905
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:47.876309
SID:	2033132
Source Port:	49947
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:55.132737
SID:	2033132
Source Port:	49968
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:40.719368
SID:	2033132
Source Port:	49926
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:23.210292
SID:	2033132
Source Port:	49709
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:32.118552
SID:	2033132
Source Port:	49901
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:04.112008
SID:	2033132
Source Port:	49989
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:35:12.328814
SID:	2033132
Source Port:	50013
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:58.917317
SID:	2033132
Source Port:	50139
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.7 - Destination IP: 3.68.171.119

Timestamp:	03/20/24-11:33:44.385003
SID:	2825563
Source Port:	49776
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:18.427231
SID:	2033132
Source Port:	49701
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 52.28.247.255

Timestamp:	03/20/24-11:32:54.912030
SID:	2033132
Source Port:	49722
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 18.197.239.109

Timestamp:	03/20/24-11:34:34.863597
SID:	2033132
Source Port:	49909
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.7 - Destination IP: 3.66.38.117

Timestamp:	03/20/24-11:35:51.589149
SID:	2033132
Source Port:	50118
Destination Port:	12377
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\system.exe

Avira: detection malicious, Label: TR/Dropper.Gen7

Found malware configuration

Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack

Malware Configuration Extractor: Njrat {"Install Dir": "TEMP", "Install Name": "system.exe", "Startup": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Campaign ID": "dikorolevstvonahui", "Version": "Njrat 0.7 Golden By Hassan Amiri", "Network Seprator": "|Hassan|", "Mutex": "Windows Update", "Install Flag": "True"}

Multi AV Scanner detection for domain / URL

Source: 6.tcp.eu.ngrok.io

Virustotal: Detection: 10%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\system.exe	ReversingLabs: Detection: 86%
Source: C:\Users\user\AppData\Local\Temp\system.exe	Virustotal: Detection: 81%			Perma Link

Multi AV Scanner detection for submitted file

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	ReversingLabs: Detection: 86%
Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Virustotal: Detection: 80%			Perma Link

Yara detected Njrat

Source: Yara match	File source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE
Source: Yara match	File source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe PID: 5100, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\system.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Joe Sandbox ML: detected

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49700 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49701 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49701 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49707 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49709 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49709 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49710 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49710 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49711 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49711 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49712 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49712 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49713 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49714 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49714 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49715 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49715 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49716 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49716 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49717 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49717 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49718 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49718 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49719 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49719 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49720 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49721 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49722 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49722 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49724 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49724 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49726 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49726 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49727 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49727 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49728 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49728 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49729 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49729 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49730 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49731 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49731 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49732 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49732 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49733 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49733 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49734 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49734 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49735 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49735 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49736 -> 52.28.247.255:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49737 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49738 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49739 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49740 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49741 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49742 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49743 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49744 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49745 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49746 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49747 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49748 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49749 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49750 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49751 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49752 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49753 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49754 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49755 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49756 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49757 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49758 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49759 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49760 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49761 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49762 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49763 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49764 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49765 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49766 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49767 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49768 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49769 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49769 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49770 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49771 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49772 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49773 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49774 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49775 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49776 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49776 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49777 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49778 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49779 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49780 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49781 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49782 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49783 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49784 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49785 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49786 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49787 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49788 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49789 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49790 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49791 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49792 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49793 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49794 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49795 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49796 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49797 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49798 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49799 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49800 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49801 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49802 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49803 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49804 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49805 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49806 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49807 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49808 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49809 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49809 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49810 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49811 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49812 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49813 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49814 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49815 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49816 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49817 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49818 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49819 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49820 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49821 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49821 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49822 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49823 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49824 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49825 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49826 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49827 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49828 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49829 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49830 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49831 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49832 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49833 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49834 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49835 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49836 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49837 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49838 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49839 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49840 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49841 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49842 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49843 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49844 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49845 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49846 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49847 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49848 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49849 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49850 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49851 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49852 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49853 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49854 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49855 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49856 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49857 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49858 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49859 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49860 -> 3.68.171.119:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49861 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49862 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49863 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49864 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49865 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49866 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49867 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49868 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49869 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49870 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49871 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49872 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49873 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49874 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49875 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49876 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49877 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49878 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49879 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49880 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49881 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49882 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49883 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49884 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49885 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49886 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49887 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49888 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49889 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49890 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49891 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49892 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49893 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49894 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49894 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49895 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49896 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49897 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49898 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49899 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49900 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49901 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49902 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49903 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49904 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49905 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49906 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49907 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49908 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49909 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49910 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49911 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49912 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49913 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49914 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49915 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49916 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49917 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49918 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49919 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49920 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49921 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49922 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49923 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49924 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49925 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49926 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49927 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49928 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49929 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49930 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49931 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49932 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49933 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49934 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49935 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49935 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49936 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49937 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49938 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49939 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49940 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49941 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49942 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49943 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49944 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49945 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49946 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49947 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49948 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49949 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49950 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49951 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49952 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49953 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49954 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49955 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49956 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49957 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49958 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49959 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49960 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49961 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49962 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49963 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49964 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49965 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49966 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49967 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49968 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49969 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49970 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49971 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49972 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49973 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49974 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49975 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49976 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49977 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49978 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49979 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49980 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49981 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49982 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49983 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:49983 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49984 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49985 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49986 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49987 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49988 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49989 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49990 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49991 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49992 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49993 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49994 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49995 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49996 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49997 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49998 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:49999 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50000 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50001 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50002 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50003 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50004 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50005 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50006 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50007 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50007 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50008 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50008 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50009 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50010 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50011 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50012 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50013 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50014 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50015 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50015 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50016 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50017 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50018 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50019 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50020 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50021 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50022 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50023 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50024 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50025 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50026 -> 18.197.239.109:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50027 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50028 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50029 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50030 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50031 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50032 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50033 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50033 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50034 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50035 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50036 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50037 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50038 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50039 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50039 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50040 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50041 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50042 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50043 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50044 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50044 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50045 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50045 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50046 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50047 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50048 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50049 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50050 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50051 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50052 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50053 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50054 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50055 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50056 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50057 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50058 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50059 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50060 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50061 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50062 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50063 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50064 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50064 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50065 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50066 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50067 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50068 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50069 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50070 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50071 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50071 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50072 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50073 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50074 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50075 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50076 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50077 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50078 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50079 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50080 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50081 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50082 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50083 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50084 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50085 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50086 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50087 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50088 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50089 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50090 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50091 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50092 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50093 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50094 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50095 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50096 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50097 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50098 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50099 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50100 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50101 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50102 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50103 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50104 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50105 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50106 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50107 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50108 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50109 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50110 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50111 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50112 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50113 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50114 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50115 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50115 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50116 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50116 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50117 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50118 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50119 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50120 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50121 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50122 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50123 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50124 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50125 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50126 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50127 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50128 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50129 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50130 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50131 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50132 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50133 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50134 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50135 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50136 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50137 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50138 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50139 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50140 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50141 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50142 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50143 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50144 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50145 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50146 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50147 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50148 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50149 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50150 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50151 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50151 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50152 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.7:50152 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50153 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50154 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50155 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50156 -> 3.66.38.117:12377
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.7:50157 -> 3.66.38.117:12377

Source: global traffic	TCP traffic: 192.168.2.7:49700 -> 52.28.247.255:12377
Source: global traffic	TCP traffic: 192.168.2.7:49737 -> 3.68.171.119:12377
Source: global traffic	TCP traffic: 192.168.2.7:49861 -> 18.197.239.109:12377
Source: global traffic	TCP traffic: 192.168.2.7:50027 -> 3.66.38.117:12377

Source: Joe Sandbox View	IP Address: 3.66.38.117 3.66.38.117
Source: Joe Sandbox View	IP Address: 52.28.247.255 52.28.247.255
Source: Joe Sandbox View	IP Address: 18.197.239.109 18.197.239.109
Source: Joe Sandbox View	IP Address: 3.68.171.119 3.68.171.119

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: 6.tcp.eu.ngrok.io

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE
Source: Yara match	File source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe PID: 5100, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\AppData\Local\Temp\system.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\system.exe	Code function: 10_2_030EEF10	10_2_030EEF10
Source: C:\Users\user\AppData\Local\Temp\system.exe	Code function: 10_2_030E4CE0	10_2_030E4CE0
Source: C:\Users\user\AppData\Local\Temp\system.exe	Code function: 10_2_030EAB37	10_2_030EAB37
Source: C:\Users\user\AppData\Local\Temp\system.exe	Code function: 10_2_057F15D0	10_2_057F15D0
Source: C:\Users\user\AppData\Local\Temp\system.exe	Code function: 10_2_057F1BB3	10_2_057F1BB3
Source: C:\Users\user\AppData\Local\Temp\system.exe	Code function: 10_2_057FB308	10_2_057FB308
Source: C:\Users\user\AppData\Local\Temp\system.exe	Code function: 10_2_057F9BC0	10_2_057F9BC0

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, 00000001.00000002.1328507419.00000000008BE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameclr.dllT vs 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Section loaded: sxs.dll	Jump to behavior

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.phis.troj.evad.winEXE@3/2@4/4

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\system.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\system.exe	Mutant created: \Sessions\1\BaseNamedObjects\Windows Update

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

File created: C:\Users\user\AppData\Local\Temp\system.exe

Jump to behavior

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	ReversingLabs: Detection: 86%
Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Virustotal: Detection: 80%

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

File read: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe "C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe"
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process created: C:\Users\user\AppData\Local\Temp\system.exe "C:\Users\user\AppData\Local\Temp\system.exe"
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process created: C:\Users\user\AppData\Local\Temp\system.exe "C:\Users\user\AppData\Local\Temp\system.exe"	Jump to behavior

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: system.exe.1.dr, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, OK.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Local\Temp\system.exe

Code function: 10_2_057F218B pushfd ; retf

10_2_057F2191

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

File created: C:\Users\user\AppData\Local\Temp\system.exe

Jump to dropped file

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Memory allocated: EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Memory allocated: 2750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Memory allocated: 30E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Memory allocated: 3190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Memory allocated: 5190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Memory allocated: 6D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Memory allocated: 7D60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\system.exe	Window / User API: threadDelayed 697	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Window / User API: threadDelayed 5110	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Window / User API: threadDelayed 3425	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Window / User API: foregroundWindowGot 764	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Window / User API: foregroundWindowGot 784	Jump to behavior

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe TID: 4040	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe TID: 5392	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe TID: 7420	Thread sleep count: 697 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe TID: 7420	Thread sleep time: -69700s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe TID: 7396	Thread sleep count: 5110 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe TID: 7396	Thread sleep time: -5110000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe TID: 7396	Thread sleep count: 3425 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe TID: 7396	Thread sleep time: -3425000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, 00000001.00000002.1328507419.000000000092F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: system.exe, 0000000A.00000002.3729775618.0000000001392000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\system.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Process created: C:\Users\user\AppData\Local\Temp\system.exe "C:\Users\user\AppData\Local\Temp\system.exe"

Jump to behavior

Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:42:33 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 02:18:43 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 01:23:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 09:47:17 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 00:58:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:49:33 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 01:38:26 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 11:35:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 06:35:05 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 02:16:47 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:00:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 02:33:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:44:12 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 13:34:58 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:58:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 03:41:24 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 05:39:22 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 00:02:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 00:26:56 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:18:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 19:54:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:54:51 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 12:25:24 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:55:39 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 09:38:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 09:11:41 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 03:52:13 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:47:26 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 07:24:57 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 14:56:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:24:47 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:07:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:05:54 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 03:21:30 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 12:36:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:44:40 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:19:43 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 00:33:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:02:47 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:12:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 06:14:57 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 02:25:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 16:33:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 06:40:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 14:39:13 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 20:40:29 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 17:45:52 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:05:44 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:52:34 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:59:30 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 01:43:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 14:59:07 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 13:23:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 13:00:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:40:25 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 20:00:41 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 10:01:24 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:59:59 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 02:37:07 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:23:31 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/13 \| 05:51:13 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 12:51:13 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 02:43:55 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:07:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 10:21:18 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 12:41:55 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 20:01:56 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:43:10 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 16:07:42 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 14:22:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:27:18 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:36:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 13:14:12 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:58:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 13:04:53 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:30:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 02:04:28 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:15:42 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 13:12:04 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:34:15 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 00:24:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:49:29 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 07:40:02 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 02:18:31 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 19:49:33 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 19:53:21 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 01:19:34 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 19:51:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:30:29 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:28:34 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:27:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:53:21 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:42:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:03:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 12:25:47 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:17:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:37:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:32:11 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 09:41:46 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 00:08:07 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:43:21 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:57:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:03:00 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 20:00:26 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 07:37:30 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 20:25:13 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 12:15:28 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:08:55 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:40:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:18:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:39:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 02:20:28 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 21:16:49 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:39:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 05:36:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 00:58:59 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 04:51:52 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:52:15 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 00:07:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 20:35:43 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:18:04 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 14:17:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 16:57:57 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:03:33 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:43:25 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 07:49:17 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 12:00:00 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:27:43 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 13:24:46 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003485000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 07:37:44 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:43:10 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:37:02 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 07:50:11 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 17:18:56 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:44:40 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 07:40:52 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 16:05:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 16:26:22 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:57:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:56:58 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 00:05:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 13:18:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 14:23:46 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:50:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 12:41:18 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 13:25:01 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:08:17 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 12:31:59 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:20:05 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 13:26:31 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 12:18:48 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 16:44:45 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:32:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 01:08:45 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 01:54:40 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 12:03:30 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:21:22 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 02:16:01 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 16:26:21 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 15:27:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:01:53 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 05:17:44 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 05:54:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 13:54:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:01:07 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 02:21:58 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 01:23:13 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 07:39:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 06:10:33 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:41:03 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 01:40:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:10:43 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:47:54 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 12:13:31 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:01:54 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 13:54:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:05:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 03:19:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:22:53 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 21:48:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 20:28:12 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:38:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:28:24 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 16:22:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:36:48 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:25:33 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 20:43:18 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 07:41:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:34:02 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:16:29 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 12:24:17 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 21:46:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 17:22:44 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 01:00:42 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:49:57 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 02:06:42 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:33:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:48:03 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:42:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 21:02:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 09:34:12 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:46:15 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 01:36:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 01:35:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 21:25:52 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 02:22:12 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 15:09:45 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 11:23:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:51:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 12:59:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:02:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 01:57:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 23:58:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 09:56:07 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 08:24:49 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 13:15:05 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 09:04:00 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/20 \| 20:25:45 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 20:20:47 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/13 \| 05:50:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 00:27:49 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/20 \| 11:36:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:45:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 01:17:11 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:25:49 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 03:44:18 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:35:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 01:16:40 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 12:43:02 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 15:29:39 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:04:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:26:21 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 01:55:26 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:28:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:54:51 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 02:50:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:57:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 07:25:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 09:19:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 21:46:00 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 06:17:34 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:29:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 12:28:18 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 12:20:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:05:46 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:52:45 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 20:03:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 00:52:40 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:13:21 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:04:29 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 01:37:03 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:58:57 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:39:05 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 09:08:39 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:58:44 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 13:20:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 20:00:51 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:56:56 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003195000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 07:36:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 10:36:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:18:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:38:39 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 13:16:11 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 02:19:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 19:59:24 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 20:52:58 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:54:46 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 15:44:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 12:22:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 09:57:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:50:51 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 00:19:15 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:22:02 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:44:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:22:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 02:55:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:57:04 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:06:47 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 07:48:58 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 16:00:13 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 09:54:06 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/21 \| 02:56:05 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 16:36:56 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:40:53 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:48:31 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 05:52:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 12:55:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 16:40:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 00:42:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 02:12:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 07:37:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:41:02 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 00:48:24 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 02:14:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:40:55 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/19 \| 16:25:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 10:37:22 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 21:07:46 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:32:03 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:06:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 22:18:03 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:28:52 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 08:47:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 06:07:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:06:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 20:50:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 20:26:01 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:31:07 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:22:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:48:46 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 20:41:52 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:56:03 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 13:14:11 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 07:09:55 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:57:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:11:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 12:51:29 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:21:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 01:10:10 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 21:10:41 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:30:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 07:45:56 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:23:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:11:45 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 05:18:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 01:05:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:22:15 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:23:46 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:16:13 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 09:12:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 13:06:30 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 18:13:46 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:41:00 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 07:55:01 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 11:44:44 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:49:58 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 23:51:05 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 12:52:07 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 21:15:56 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 21:48:07 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:51:11 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 01:01:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:02:21 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:39:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:41:26 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 13:36:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 13:55:29 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 19:58:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:00:56 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 13:47:48 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 05:02:31 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 20:43:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 07:42:28 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 12:17:55 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:34:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 20:26:11 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 07:32:30 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 23:54:58 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:47:56 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:56:12 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 21:21:08 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:39:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:59:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:14:47 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:29:24 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:17:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:44:03 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 16:06:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 09:43:17 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 07:18:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 20:34:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 21:28:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 05:09:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 15:23:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:27:24 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:49:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:13:01 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 12:24:55 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:43:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:03:13 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 16:54:41 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 13:32:59 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 00:06:25 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:40:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 14:38:59 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 03:54:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 09:03:22 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 06:20:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:55:30 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 16:27:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:55:59 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:00:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 14:09:23 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 18:24:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:28:32 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:35:41 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:40:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:53:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 15:00:43 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 05:54:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 00:53:05 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:43:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 19:48:03 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 12:21:28 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 09:25:22 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:42:18 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:21:13 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 08:38:42 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:59:14 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 02:01:42 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:44:06 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:51:21 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:30:59 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 19:51:20 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:36:02 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 22:00:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 17:49:22 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 10:06:24 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:43:04 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:22:55 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:24:53 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:57:26 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:11:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:26:43 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 10:03:25 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 09:33:12 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 11:42:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:27:49 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 20:41:17 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:14:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 07:59:00 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:48:53 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 00:52:39 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 14:19:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 07:50:28 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:46:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 20:25:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 13:51:36 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:22:18 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 07:08:47 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 09:45:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 06:37:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/26 \| 01:49:44 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:23:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 06:54:28 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 05:29:04 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 13:15:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/17 \| 12:47:19 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:19:56 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 18:14:00 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 08:46:42 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:50:15 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/21 \| 20:03:57 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:50:54 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:03:40 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 07:59:52 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 19:52:08 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/03 \| 20:37:29 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 16:52:57 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/30 \| 20:11:47 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 11:30:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:48:41 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 15:31:27 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/26 \| 08:38:52 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/11 \| 02:12:31 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/28 \| 07:06:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:18:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 06:19:59 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 16:26:39 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 10:36:16 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 17:53:49 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:00:02 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 23:11:15 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 02:02:17 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:13:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 07:55:37 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/30 \| 12:04:06 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:43:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:51:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 18:01:42 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 08:45:26 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 17:32:25 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:26:04 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/06 \| 01:11:25 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/10 \| 22:47:28 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 00:51:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 05:20:24 - Program Manager
Source: system.exe, 0000000A.00000002.3743859728.0000000003338000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.00000000036D7000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3743859728.0000000003635000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 06:52:09 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 11:29:04 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 13:55:50 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/28 \| 13:30:35 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:20:55 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 03:26:30 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 14:57:58 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/08 \| 17:29:38 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 15:42:17 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 18:48:21 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/23 \| 23:50:12 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3747725829.0000000004B99000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/04/24 \| 01:36:22 - Program Manager
Source: system.exe, 0000000A.00000002.3747725829.0000000004199000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/03/23 \| 19:30:18 - Program Manager

Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Queries volume information: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\system.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\system.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\system.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables zone checking for all users

Source: C:\Users\user\AppData\Local\Temp\system.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Source: system.exe, 0000000A.00000002.3753326094.0000000006B72000.00000004.00000020.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3753898037.0000000006BD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rogramFiles%\Windows Defender\MsMpeng.exe
Source: system.exe, 0000000A.00000002.3753326094.0000000006B72000.00000004.00000020.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3753681735.0000000006BBD000.00000004.00000020.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3753898037.0000000006BD0000.00000004.00000020.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3753326094.0000000006B60000.00000004.00000020.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3729775618.0000000001392000.00000004.00000020.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3753575234.0000000006B98000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: system.exe, 0000000A.00000002.3753326094.0000000006B72000.00000004.00000020.00020000.00000000.sdmp, system.exe, 0000000A.00000002.3753898037.0000000006BD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\system.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE
Source: Yara match	File source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe PID: 5100, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, type: SAMPLE
Source: Yara match	File source: 1.0.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.3d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.2775ffc.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe PID: 5100, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\system.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	81%	Virustotal		Browse
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	100%	Avira	TR/Dropper.Gen7
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\system.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Local\Temp\system.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\system.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.Bladabhindi
C:\Users\user\AppData\Local\Temp\system.exe	82%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
6.tcp.eu.ngrok.io	11%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
6.tcp.eu.ngrok.io	52.28.247.255	true	true	11%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.66.38.117	unknown	United States	16509	AMAZON-02US	true
52.28.247.255	6.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
18.197.239.109	unknown	United States	16509	AMAZON-02US	true
3.68.171.119	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1412298
Start date and time:	2024-03-20 11:31:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe
Detection:	MAL
Classification:	mal100.phis.troj.evad.winEXE@3/2@4/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 98% Number of executed functions: 47 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe, PID 5100 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:32:14	API Interceptor	444400x Sleep call for process: system.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
3.66.38.117	U22p1GcCSb.exe	Get hash	malicious	Njrat	Browse
	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse
	ziTLBa3N50.exe	Get hash	malicious	Njrat	Browse
	1.exe	Get hash	malicious	Njrat	Browse
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse
	Terraria.exe	Get hash	malicious	Njrat	Browse
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	m5l9v13hIi.exe	Get hash	malicious	Njrat	Browse
	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse
52.28.247.255	U22p1GcCSb.exe	Get hash	malicious	Njrat	Browse
	M5vARlA2c4.exe	Get hash	malicious	Njrat	Browse
	1.exe	Get hash	malicious	Njrat	Browse
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	QsKtlzYaKF.exe	Get hash	malicious	Njrat	Browse
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse
	ZuXcnAYgVp.exe	Get hash	malicious	Njrat	Browse
	wiUnP1h5Ex.exe	Get hash	malicious	Njrat	Browse
18.197.239.109	U22p1GcCSb.exe	Get hash	malicious	Njrat	Browse
	Client.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
	zyx3qItgQK.exe	Get hash	malicious	Njrat	Browse
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse
	rkIcS0Y2WY.exe	Get hash	malicious	Njrat	Browse
	30b4CoDmKk.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	dKe1GfZOs1.exe	Get hash	malicious	Njrat	Browse
	bRxR.exe	Get hash	malicious	AsyncRAT, DcRat	Browse
3.68.171.119	U22p1GcCSb.exe	Get hash	malicious	Njrat	Browse
	M5vARlA2c4.exe	Get hash	malicious	Njrat	Browse
	YTYyFVemXR.exe	Get hash	malicious	Njrat	Browse
	zyx3qItgQK.exe	Get hash	malicious	Njrat	Browse
	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse
	N1aqZIb7KG.exe	Get hash	malicious	Njrat	Browse
	m5l9v13hIi.exe	Get hash	malicious	Njrat	Browse
	sCXwkZrcZ3.exe	Get hash	malicious	Njrat	Browse
	X5eo58PPCB.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6.tcp.eu.ngrok.io	U22p1GcCSb.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	Client.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	3.69.157.220
	M5vARlA2c4.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	YTYyFVemXR.exe	Get hash	malicious	Njrat	Browse	3.68.171.119
	zyx3qItgQK.exe	Get hash	malicious	Njrat	Browse	3.69.115.178
	NfJ0jC2dPr.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	ziTLBa3N50.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	1.exe	Get hash	malicious	Njrat	Browse	3.66.38.117
	226dVJ2zRZ.exe	Get hash	malicious	Njrat	Browse	3.69.157.220
	IsJb5hB84q.exe	Get hash	malicious	Njrat	Browse	3.66.38.117

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	http://slu.gg/BLtWe#BASE64EMAIL	Get hash	malicious	Unknown	Browse	108.138.106.108
	ckDJ37LQeU.elf	Get hash	malicious	Gafgyt	Browse	34.249.145.219
	https://wor6a9e8f3001534eb85e273da4065fbbkerow-lab-0665.pilnik9.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	18.238.49.67
	uJv15fVDWx.elf	Get hash	malicious	Gafgyt	Browse	34.249.145.219
	https://fom.li/f/MhEXOqZr8m	Get hash	malicious	HTMLPhisher	Browse	52.219.156.55
	Excel.xlsx	Get hash	malicious	Unknown	Browse	54.230.163.11
	Excel.xlsx	Get hash	malicious	Unknown	Browse	54.230.163.57
	https://yvpyausvcogp.s3.us-west-1.amazonaws.com/yvpyausvcogp.html#4bIeGj6900XRlr493ihxqkyqdnm1686ZUDVKYYVGWZPZHY574812/733106u21#wji0v7eb0jz2ydrwqgv6hlp2y3a8kbhg333z7mrxca8j5qkc77wp26f	Get hash	malicious	Phisher	Browse	52.219.192.10
	https://yvpyausvcogp.s3.us-west-1.amazonaws.com/yvpyausvcogp.html#5AaWUM6900fTdY493dcsdnnxxwd1686AGCZAMHEYELPJNI574812/733106Y21#ir4gwkusvhb5wcsmp52cfv2d5haj3j6qsyq6hxkqush8d9oi1fvxnmc	Get hash	malicious	Phisher	Browse	52.219.221.18
	17109195092037b2679fb1356b5f6633d23d167e40f2663f685e897ff6aadaf9005c2b694a887.dat-decoded.exe	Get hash	malicious	XWorm	Browse	34.216.89.67
AMAZON-02US	http://slu.gg/BLtWe#BASE64EMAIL	Get hash	malicious	Unknown	Browse	108.138.106.108
	ckDJ37LQeU.elf	Get hash	malicious	Gafgyt	Browse	34.249.145.219
	https://wor6a9e8f3001534eb85e273da4065fbbkerow-lab-0665.pilnik9.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	18.238.49.67
	uJv15fVDWx.elf	Get hash	malicious	Gafgyt	Browse	34.249.145.219
	https://fom.li/f/MhEXOqZr8m	Get hash	malicious	HTMLPhisher	Browse	52.219.156.55
	Excel.xlsx	Get hash	malicious	Unknown	Browse	54.230.163.11
	Excel.xlsx	Get hash	malicious	Unknown	Browse	54.230.163.57
	https://yvpyausvcogp.s3.us-west-1.amazonaws.com/yvpyausvcogp.html#4bIeGj6900XRlr493ihxqkyqdnm1686ZUDVKYYVGWZPZHY574812/733106u21#wji0v7eb0jz2ydrwqgv6hlp2y3a8kbhg333z7mrxca8j5qkc77wp26f	Get hash	malicious	Phisher	Browse	52.219.192.10
	https://yvpyausvcogp.s3.us-west-1.amazonaws.com/yvpyausvcogp.html#5AaWUM6900fTdY493dcsdnnxxwd1686AGCZAMHEYELPJNI574812/733106Y21#ir4gwkusvhb5wcsmp52cfv2d5haj3j6qsyq6hxkqush8d9oi1fvxnmc	Get hash	malicious	Phisher	Browse	52.219.221.18
	17109195092037b2679fb1356b5f6633d23d167e40f2663f685e897ff6aadaf9005c2b694a887.dat-decoded.exe	Get hash	malicious	XWorm	Browse	34.216.89.67
AMAZON-02US	http://slu.gg/BLtWe#BASE64EMAIL	Get hash	malicious	Unknown	Browse	108.138.106.108
	ckDJ37LQeU.elf	Get hash	malicious	Gafgyt	Browse	34.249.145.219
	https://wor6a9e8f3001534eb85e273da4065fbbkerow-lab-0665.pilnik9.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	18.238.49.67
	uJv15fVDWx.elf	Get hash	malicious	Gafgyt	Browse	34.249.145.219
	https://fom.li/f/MhEXOqZr8m	Get hash	malicious	HTMLPhisher	Browse	52.219.156.55
	Excel.xlsx	Get hash	malicious	Unknown	Browse	54.230.163.11
	Excel.xlsx	Get hash	malicious	Unknown	Browse	54.230.163.57
	https://yvpyausvcogp.s3.us-west-1.amazonaws.com/yvpyausvcogp.html#4bIeGj6900XRlr493ihxqkyqdnm1686ZUDVKYYVGWZPZHY574812/733106u21#wji0v7eb0jz2ydrwqgv6hlp2y3a8kbhg333z7mrxca8j5qkc77wp26f	Get hash	malicious	Phisher	Browse	52.219.192.10
	https://yvpyausvcogp.s3.us-west-1.amazonaws.com/yvpyausvcogp.html#5AaWUM6900fTdY493dcsdnnxxwd1686AGCZAMHEYELPJNI574812/733106Y21#ir4gwkusvhb5wcsmp52cfv2d5haj3j6qsyq6hxkqush8d9oi1fvxnmc	Get hash	malicious	Phisher	Browse	52.219.221.18
	17109195092037b2679fb1356b5f6633d23d167e40f2663f685e897ff6aadaf9005c2b694a887.dat-decoded.exe	Get hash	malicious	XWorm	Browse	34.216.89.67
AMAZON-02US	http://slu.gg/BLtWe#BASE64EMAIL	Get hash	malicious	Unknown	Browse	108.138.106.108
	ckDJ37LQeU.elf	Get hash	malicious	Gafgyt	Browse	34.249.145.219
	https://wor6a9e8f3001534eb85e273da4065fbbkerow-lab-0665.pilnik9.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	18.238.49.67
	uJv15fVDWx.elf	Get hash	malicious	Gafgyt	Browse	34.249.145.219
	https://fom.li/f/MhEXOqZr8m	Get hash	malicious	HTMLPhisher	Browse	52.219.156.55
	Excel.xlsx	Get hash	malicious	Unknown	Browse	54.230.163.11
	Excel.xlsx	Get hash	malicious	Unknown	Browse	54.230.163.57
	https://yvpyausvcogp.s3.us-west-1.amazonaws.com/yvpyausvcogp.html#4bIeGj6900XRlr493ihxqkyqdnm1686ZUDVKYYVGWZPZHY574812/733106u21#wji0v7eb0jz2ydrwqgv6hlp2y3a8kbhg333z7mrxca8j5qkc77wp26f	Get hash	malicious	Phisher	Browse	52.219.192.10
	https://yvpyausvcogp.s3.us-west-1.amazonaws.com/yvpyausvcogp.html#5AaWUM6900fTdY493dcsdnnxxwd1686AGCZAMHEYELPJNI574812/733106Y21#ir4gwkusvhb5wcsmp52cfv2d5haj3j6qsyq6hxkqush8d9oi1fvxnmc	Get hash	malicious	Phisher	Browse	52.219.221.18
	17109195092037b2679fb1356b5f6633d23d167e40f2663f685e897ff6aadaf9005c2b694a887.dat-decoded.exe	Get hash	malicious	XWorm	Browse	34.216.89.67

Process:	C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	507
Entropy (8bit):	5.344008188221104
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M0kvoDLI4MWuCqDLI4MWuPTAq1KDLI4M6:MLU84jE4K5E4KH1qE4j
MD5:	285ADD706E818D58486213C030BD9ED5
SHA1:	3593842190DB067FC23F4E3E7A8FC69263800A47
SHA-256:	20B63D70AA9351A7ECC1E8B4A8099BC7D6A4500BA11DE6BCFB028D09475A6D7E
SHA-512:	935832497DF8AD8A4676947C0BCEC89C312753E604B3C2AAAAA42CDF2DFEDD5151385B44589C8E304ABA26D9578DFF1FE841EDE6EB5E784208984584FB8B2201
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\system.exe

Download File

Process:	C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	5.607362332213255
Encrypted:	false
SSDEEP:	384:BvZyQ5mi1z1yzMDyjd30MNZLSuE+myGDEzZqIij+ZsNO3PlpJKkkjh/TzF7pWn1w:BRz5mi1zE4+hkMNZ2QmyZuXQ/oMG+L
MD5:	760C3907F64EA9FB60E13D4847C083A6
SHA1:	FA3E06C44CD48A02ACB359D9E6ADEE88A2CD561D
SHA-256:	592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE20A5A556AD837FC2BF90
SHA-512:	70ED946DD187E901F378CE10AF1626CC27BEAE3194B5ACEF76FDB9C480753A806A0003EFD6FDF338823D3A372852698F9BEAF1F0640AB84B305C5C6C4B874084
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\system.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\system.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\system.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\system.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87% Antivirus: Virustotal, Detection: 82%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................... ............@.................................T...W.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......@y...J......T....x................................................(......(.....s.........s.........s.........s.........s..........0..........~....o......0..........~....o......0..........~....o......0..........~....o......0..........~....o......0................,.........o....9....~....,,~.........(....o...., r...p......(....s....zs.........~.........(.....o....(...+..lu....%-.&.+.%.(.....o...............&r;..p..........o....o......(.......o....s....z~........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.607362332213255
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe
File size:	44'032 bytes
MD5:	760c3907f64ea9fb60e13d4847c083a6
SHA1:	fa3e06c44cd48a02acb359d9e6adee88a2cd561d
SHA256:	592cdad0a5b0ae90e0c812aecb2677096af06cf941ce20a5a556ad837fc2bf90
SHA512:	70ed946dd187e901f378ce10af1626cc27beae3194b5acef76fdb9c480753a806a0003efd6fdf338823d3a372852698f9beaf1f0640ab84b305c5c6c4b874084
SSDEEP:	384:BvZyQ5mi1z1yzMDyjd30MNZLSuE+myGDEzZqIij+ZsNO3PlpJKkkjh/TzF7pWn1w:BRz5mi1zE4+hkMNZ2QmyZuXQ/oMG+L
TLSH:	DF13D74DB694E174D5FF8BF1B4A2B2890B71A01BA802D30F99F154D94BB3EC09611EE7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......e................................. ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40c3ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65A706E6 [Tue Jan 16 22:44:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc354	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa3b4	0xa400	31793107dd6719178a4497837bfef2e3	False	0.42092225609756095	data	5.700380674610364	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x400	0x400	e6bddab8cfc5a0b85c6b2404ef045c60	False	0.3017578125	data	3.5160679793070893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	2f56c8233a8bed9d40526d0054d418e0	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xe058	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/20/24-11:34:17.117522	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49861	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:17.826009	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49863	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:17.476282	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49862	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:27.899372	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50058	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:34.678105	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49759	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:27.566069	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50057	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:28.245313	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50059	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:34.195221	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49758	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:58.903009	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49979	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:57.865801	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49976	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:58.254077	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49977	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:58.553691	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49978	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:36.241858	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49762	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:28.973268	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50061	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:30.046081	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49751	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:30.732966	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49752	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:56.485509	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49972	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:56.878214	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49973	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:02.149082	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49983	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:02.364485	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49984	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:25.260873	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50050	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:25.531231	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50051	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:28.630865	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50060	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:29.276158	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50062	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:29.374696	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49750	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:31.884427	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49754	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:56.145691	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49971	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:57.549082	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49975	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:59.936048	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49982	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:35.696647	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49761	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:37.609991	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49765	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:03.102543	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49986	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:38.185703	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49766	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:32.461422	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49755	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:33.031971	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49756	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:26.897863	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50055	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:30.676925	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50066	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:35.196346	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49760	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:38.997242	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49768	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:19.929064	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49869	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:27.221021	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50056	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:30.992917	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50067	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:33.599697	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49757	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:57.188989	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49974	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:02.699409	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49985	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:38.618293	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49767	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:19.154412	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49867	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:19.490074	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49868	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:18.142756	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49864	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:26.549705	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50054	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:30.312006	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50065	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:59.242532	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49980	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:30.070607	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50064	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:18.500137	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49865	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:37.145985	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49764	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:29.568248	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50063	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:31.288802	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49753	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:55.824936	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49970	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:59.554934	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49981	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:25.876753	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50052	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:26.226942	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50053	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:36.708505	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49763	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:18.837574	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49866	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:16.737525	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49860	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:28.679104	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49749	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:31.699520	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50069	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:24.138268	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50047	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:24.505930	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50048	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:31.389803	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50068	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:27.273761	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49747	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:28.024320	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49748	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:41.351980	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49769	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:24.816974	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50049	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:16.817845	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50026	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:16.488629	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50025	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:15.740414	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50023	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:15.429587	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50022	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:16.083968	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50024	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:30.070894	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50064	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:41.447377	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49769	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:14.713390	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50020	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:15.066883	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50021	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:23.212192	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50044	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:23.570737	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50045	12377	192.168.2.7	3.66.38.117
03/20/24-11:36:04.906053	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50153	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:14.987532	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49855	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:23.609925	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49880	12377	192.168.2.7	18.197.239.109
03/20/24-11:36:04.682670	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50152	12377	192.168.2.7	3.66.38.117
03/20/24-11:36:03.823872	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50151	12377	192.168.2.7	3.66.38.117
03/20/24-11:36:05.605615	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50155	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:24.335536	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49882	12377	192.168.2.7	18.197.239.109
03/20/24-11:36:08.965711	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50157	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:13.688476	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49851	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:16.367321	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49859	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:25.016109	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49884	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:21.483338	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50039	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:15.714036	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49857	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:20.401477	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50036	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:21.039914	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50038	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:17.868211	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49738	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:52.061648	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49959	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:50.745637	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49955	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:51.375402	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49957	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:14.318067	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49853	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:07.495588	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49999	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:20.953562	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49741	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:13.124179	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50015	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:18.242899	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50030	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:49.252527	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49951	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:49.946431	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49953	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:24.166404	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49743	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:42.531478	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49772	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:52.823289	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49961	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:54.108362	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49965	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:05.421447	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49993	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:06.799684	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49997	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:38.027431	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50083	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:44.320991	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49776	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:46.950087	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49783	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:48.452993	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49787	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:14.022066	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50018	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:34.255529	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50072	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:25.695398	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49745	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:19.679647	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50034	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:23.570446	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50045	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:41.667433	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49770	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:53.457472	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49963	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:06.164535	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49995	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:37.290745	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50081	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:40.058010	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50089	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:45.026473	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49778	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:46.184171	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49781	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:49.210510	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49789	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:32.078539	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50070	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:36.283454	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50078	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:22.955429	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49878	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:26.355630	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49888	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:18.525315	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49701	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:25.684915	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49886	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:39.322113	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50087	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:35.565237	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50076	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:22.757702	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50043	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:18.911540	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50032	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:22.286075	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49876	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:22.068097	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50041	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:43.355119	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49774	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:04.724439	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49991	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:38.668891	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50085	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:47.770524	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49785	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:34.893199	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50074	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:20.191576	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49870	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:27.372641	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49891	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:28.113362	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49893	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:21.533524	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49874	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:30.192508	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49895	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:20.872856	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49872	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:48.265775	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49948	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:55.464162	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49969	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:46.839638	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49944	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:47.560354	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49946	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:10.710965	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50008	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:54.802310	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49967	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:03.714911	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49988	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:13.408993	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50016	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:02.149475	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49983	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:33.989928	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50071	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:12.641567	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50014	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:11.957579	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50012	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:58.509910	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50138	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:19.410807	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50033	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:09.131705	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49838	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:11.318619	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50010	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:16.179572	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49700	12377	192.168.2.7	52.28.247.255
03/20/24-11:35:56.737400	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50133	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:55.676309	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50130	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:57.055951	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50134	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:58.081582	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50137	12377	192.168.2.7	3.66.38.117
03/20/24-11:32:47.150084	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49719	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:08.094835	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49835	12377	192.168.2.7	3.68.171.119
03/20/24-11:32:44.805687	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49718	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:08.433986	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49836	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:44.807856	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49938	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:42.325724	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49717	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:43.408751	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49934	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:44.690326	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49718	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:43.906228	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49935	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:06.694097	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49831	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:07.024885	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49832	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:09.563054	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50005	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:51.071864	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49794	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:45.829349	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49941	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:42.031827	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49930	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:42.375764	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49931	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:41.050882	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50092	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:41.370552	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50093	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:51.444410	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49795	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:46.158434	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49942	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:49.574734	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49790	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:52.607560	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49798	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:49.971132	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49791	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:52.847810	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49799	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:10.620546	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50008	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:28.055645	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49711	12377	192.168.2.7	52.28.247.255
03/20/24-11:32:25.700334	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49710	12377	192.168.2.7	52.28.247.255
03/20/24-11:35:10.936184	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50009	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:57.162038	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49724	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:30.762953	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49897	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:42.446680	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50096	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:42.761045	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50097	12377	192.168.2.7	3.66.38.117
03/20/24-11:32:37.757732	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49715	12377	192.168.2.7	52.28.247.255
03/20/24-11:32:35.410672	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49714	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:31.091041	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49898	12377	192.168.2.7	18.197.239.109
03/20/24-11:36:00.175279	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50143	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:52.980610	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50122	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:04.246563	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49824	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:53.302160	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50123	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:11.612348	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49845	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:59.158456	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50140	12377	192.168.2.7	3.66.38.117
03/20/24-11:36:00.558132	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50144	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:10.184683	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49841	12377	192.168.2.7	3.68.171.119
03/20/24-11:36:01.544030	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50147	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:54.297538	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50126	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:03.099045	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49728	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:11.920634	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49846	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:04.866700	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49729	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:03.306679	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49821	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:04.618497	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49825	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:17.308189	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50027	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:29.145241	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49894	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:02.032446	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49820	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:10.594812	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49842	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:03.300697	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49821	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:09.246598	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50004	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:07.239430	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49730	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:43.907101	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49935	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:08.182517	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50001	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:35.275798	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49714	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:45.205863	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49939	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:14.301539	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49735	12377	192.168.2.7	52.28.247.255
03/20/24-11:35:07.851633	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50000	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:54.656700	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50127	12377	192.168.2.7	3.66.38.117
03/20/24-11:32:33.056000	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49713	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:12.913874	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49849	12377	192.168.2.7	3.68.171.119
03/20/24-11:36:01.883405	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50148	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:13.068943	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49734	12377	192.168.2.7	52.28.247.255
03/20/24-11:32:25.560735	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49710	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:08.696255	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49731	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:05.645733	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49828	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:05.990658	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49829	12377	192.168.2.7	3.68.171.119
03/20/24-11:36:05.260617	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50154	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:13.973934	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49852	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:15.373515	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49856	12377	192.168.2.7	3.68.171.119
03/20/24-11:36:03.870282	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50151	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:47.936901	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50112	12377	192.168.2.7	3.66.38.117
03/20/24-11:36:02.577310	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50150	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:59.921446	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49814	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:24.660853	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49883	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:20.700902	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50037	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:36.639914	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50079	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:07.155628	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49998	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:36.593716	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49914	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:58.523247	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49810	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:18.958943	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49739	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:51.037561	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49956	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:42.942790	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49773	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:53.085925	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49962	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:05.773004	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49994	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:37.639802	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50082	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:38.647767	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49920	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:21.754924	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50040	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:35.191934	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49910	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:47.326374	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49784	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:33.989433	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50071	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:19.410307	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50033	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:23.210607	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50044	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:08.829127	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49731	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:44.598423	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49777	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:45.809585	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49780	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:48.834753	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49788	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:14.371676	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50019	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:26.480864	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49746	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:49.603125	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49952	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:14.415433	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49735	12377	192.168.2.7	52.28.247.255
03/20/24-11:35:04.387917	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49990	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:38.991310	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50086	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:35.230175	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50075	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:26.066166	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49887	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:21.864563	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49742	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:22.610550	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49877	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:21.195129	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49873	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:29.055491	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49894	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:48.586731	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49949	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:47.192044	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49945	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:54.457512	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49966	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:03.429780	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49987	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:39.985886	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49924	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:20.992587	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49707	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:02.967182	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49728	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:32.787020	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49903	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:27.075718	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49890	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:13.122999	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50015	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:11.653303	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50011	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:41.353373	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49928	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:57.050561	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49724	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:34.155007	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49907	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:51.005354	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50116	12377	192.168.2.7	3.66.38.117
03/20/24-11:32:50.231857	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49720	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:01.308038	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49818	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:09.503893	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49839	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:31.880164	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49900	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:43.801622	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50100	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:53.623386	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49801	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:54.021314	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49802	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:44.533283	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50102	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:44.188697	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50101	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:45.234989	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50104	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:55.001791	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49805	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:54.329759	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49803	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:54.697470	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49804	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:44.865613	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50103	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:53.233467	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49800	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:37.626450	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49917	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:46.579513	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50108	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:58.298564	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49809	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:38.034611	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49918	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:38.261902	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49919	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:45.902723	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50106	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:45.574906	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50105	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:46.978913	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50109	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:55.360543	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49806	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:55.760587	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49807	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:56.085479	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49808	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:46.263484	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50107	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:58.895532	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49811	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:59.635836	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49813	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:47.592990	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50111	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:00.276611	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49815	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:48.287349	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50113	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:49.179070	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50115	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:36.931019	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49915	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:51.005813	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50116	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:36.238337	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49913	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:35.619599	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49911	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:38.978275	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49921	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:10.341652	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49732	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:58.306823	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49809	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:13.132924	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49734	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:41.023051	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49927	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:01.103231	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49727	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:40.332237	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49925	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:33.135084	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49904	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:04.725475	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49729	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:39.661338	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49923	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:32.475848	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49902	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:33.934293	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49906	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:01.691543	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49819	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:51.333936	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50117	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:51.948321	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50119	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:41.710293	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49929	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:34.523482	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49908	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:52.468002	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49721	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:00.980673	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49817	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:07.374557	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49833	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:56.349798	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50132	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:56.061355	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50131	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:06.441491	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49830	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:07.720986	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49834	12377	192.168.2.7	3.68.171.119
03/20/24-11:32:42.458544	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49717	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:08.834909	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49837	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:57.755247	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50136	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:57.435101	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50135	12377	192.168.2.7	3.66.38.117
03/20/24-11:32:37.628520	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49715	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:44.460402	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49937	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:44.126675	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49936	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:39.969990	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49716	12377	192.168.2.7	52.28.247.255
03/20/24-11:32:47.014622	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49719	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:50.684829	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49793	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:45.551011	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49940	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:09.869043	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50006	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:46.496883	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49943	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:42.788234	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49932	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:43.067446	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49933	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:40.364442	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50090	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:41.724346	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50094	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:10.370327	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50007	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:10.371418	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50007	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:50.346470	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49792	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:40.698176	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50091	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:43.468630	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50099	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:31.452419	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49899	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:54.943025	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49722	12377	192.168.2.7	52.28.247.255
03/20/24-11:35:43.129601	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50098	12377	192.168.2.7	3.66.38.117
03/20/24-11:32:30.398570	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49712	12377	192.168.2.7	52.28.247.255
03/20/24-11:32:40.103102	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49716	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:30.406758	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49896	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:01.242069	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49727	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:52.176986	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49797	12377	192.168.2.7	3.68.171.119
03/20/24-11:32:59.263951	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49726	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:51.822453	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49796	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:42.147885	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50095	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:11.232381	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49844	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:59.913896	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50142	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:03.516594	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49822	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:52.266879	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50120	12377	192.168.2.7	3.66.38.117
03/20/24-11:32:23.343782	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49709	12377	192.168.2.7	52.28.247.255
03/20/24-11:35:59.486563	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50141	12377	192.168.2.7	3.66.38.117
03/20/24-11:36:00.862524	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50145	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:03.920651	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49823	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:09.845798	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49840	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:53.980414	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50125	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:12.312713	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49847	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:12.624731	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49848	12377	192.168.2.7	3.68.171.119
03/20/24-11:36:01.212369	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50146	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:53.616001	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50124	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:04.923867	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49826	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:17.942826	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50029	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:10.894124	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49843	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:17.624774	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50028	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:52.604025	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50121	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:08.872270	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50003	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:08.534243	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50002	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:55.348053	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50129	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:55.002794	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50128	12377	192.168.2.7	3.66.38.117
03/20/24-11:32:30.280883	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49712	12377	192.168.2.7	52.28.247.255
03/20/24-11:36:02.225126	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50149	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:05.304929	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49827	12377	192.168.2.7	3.68.171.119
03/20/24-11:32:27.916037	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49711	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:11.632034	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49733	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:10.220692	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49732	12377	192.168.2.7	52.28.247.255
03/20/24-11:33:59.241663	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49812	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:14.679889	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49854	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:24.002154	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49881	12377	192.168.2.7	18.197.239.109
03/20/24-11:36:04.681635	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50152	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:00.620156	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49816	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:13.266494	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49850	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:16.096153	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49858	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:25.329687	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49885	12377	192.168.2.7	18.197.239.109
03/20/24-11:36:05.926777	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50156	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:15.497642	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49736	12377	192.168.2.7	52.28.247.255
03/20/24-11:35:48.617566	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50114	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:37.245206	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49916	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:45.463655	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49779	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:16.758650	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49737	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:51.723576	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49958	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:35.883636	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49912	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:49.181009	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	50115	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:21.483122	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50039	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:47.243495	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50110	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:46.570418	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49782	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:13.718956	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50017	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:34.553614	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50073	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:52.392438	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49960	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:53.783365	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49964	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:39.297153	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49922	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:19.971213	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49740	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:24.928789	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49744	12377	192.168.2.7	3.68.171.119
03/20/24-11:34:48.998960	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49950	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:50.307672	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49954	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:35.910741	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50077	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:42.101778	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49771	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:06.450352	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49996	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:20.027267	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50035	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:36.923458	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50080	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:39.656033	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50088	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:23.830195	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50046	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:26.727559	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49889	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:11.774779	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49733	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:21.990200	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49875	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:23.243718	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49879	12377	192.168.2.7	18.197.239.109
03/20/24-11:33:48.139468	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49786	12377	192.168.2.7	3.68.171.119
03/20/24-11:33:43.752379	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49775	12377	192.168.2.7	3.68.171.119
03/20/24-11:35:05.118997	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49992	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:18.555049	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50031	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:38.296846	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50084	12377	192.168.2.7	3.66.38.117
03/20/24-11:35:22.425212	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50042	12377	192.168.2.7	3.66.38.117
03/20/24-11:34:20.549165	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49871	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:27.726262	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49892	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:59.127550	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49726	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:33.476243	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49905	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:47.876309	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49947	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:55.132737	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49968	12377	192.168.2.7	18.197.239.109
03/20/24-11:34:40.719368	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49926	12377	192.168.2.7	18.197.239.109
03/20/24-11:32:23.210292	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49709	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:32.118552	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49901	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:04.112008	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49989	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:12.328814	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50013	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:58.917317	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50139	12377	192.168.2.7	3.66.38.117
03/20/24-11:33:44.385003	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49776	12377	192.168.2.7	3.68.171.119
03/20/24-11:32:18.427231	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49701	12377	192.168.2.7	52.28.247.255
03/20/24-11:32:54.912030	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49722	12377	192.168.2.7	52.28.247.255
03/20/24-11:34:34.863597	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49909	12377	192.168.2.7	18.197.239.109
03/20/24-11:35:51.589149	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	50118	12377	192.168.2.7	3.66.38.117

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2024 11:32:15.702466011 CET	49700	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:15.875304937 CET	12377	49700	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:15.875442982 CET	49700	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:16.052222967 CET	12377	49700	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:16.052299976 CET	49700	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:16.179572105 CET	49700	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:16.348970890 CET	12377	49700	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:18.185230970 CET	49701	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:18.353802919 CET	12377	49701	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:18.354015112 CET	49701	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:18.427231073 CET	49701	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:18.525110960 CET	12377	49701	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:18.525315046 CET	49701	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:18.595299006 CET	12377	49701	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:18.718250036 CET	12377	49701	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:20.541687012 CET	49707	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:20.711961985 CET	12377	49707	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:20.712240934 CET	49707	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:20.883977890 CET	12377	49707	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:20.884093046 CET	49707	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:20.992587090 CET	49707	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:21.160531998 CET	12377	49707	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:23.002799034 CET	49709	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:23.173186064 CET	12377	49709	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:23.173285007 CET	49709	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:23.210292101 CET	49709	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:23.343718052 CET	12377	49709	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:23.343781948 CET	49709	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:23.381309032 CET	12377	49709	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:23.513947010 CET	12377	49709	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:25.354180098 CET	49710	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:25.524471998 CET	12377	49710	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:25.527545929 CET	49710	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:25.560734987 CET	49710	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:25.697789907 CET	12377	49710	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:25.700334072 CET	49710	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:25.730765104 CET	12377	49710	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:25.870577097 CET	12377	49710	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:27.713644981 CET	49711	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:27.882673025 CET	12377	49711	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:27.885512114 CET	49711	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:27.916037083 CET	49711	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:28.054656029 CET	12377	49711	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:28.055644989 CET	49711	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:28.085184097 CET	12377	49711	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:28.224972963 CET	12377	49711	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:30.057584047 CET	49712	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:30.228013039 CET	12377	49712	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:30.228122950 CET	49712	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:30.280883074 CET	49712	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:30.398407936 CET	12377	49712	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:30.398570061 CET	49712	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:30.450840950 CET	12377	49712	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:30.568582058 CET	12377	49712	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:32.406934023 CET	49713	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:32.577367067 CET	12377	49713	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:32.577548027 CET	49713	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:32.748145103 CET	12377	49713	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:32.748272896 CET	49713	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:33.055999994 CET	49713	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:33.226375103 CET	12377	49713	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:35.074537039 CET	49714	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:35.242299080 CET	12377	49714	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:35.242578983 CET	49714	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:35.275798082 CET	49714	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:35.410590887 CET	12377	49714	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:35.410671949 CET	49714	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:35.443412066 CET	12377	49714	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:35.578304052 CET	12377	49714	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:37.416817904 CET	49715	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:37.587018013 CET	12377	49715	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:37.587173939 CET	49715	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:37.628520012 CET	49715	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:37.757591963 CET	12377	49715	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:37.757731915 CET	49715	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:37.799294949 CET	12377	49715	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:37.928016901 CET	12377	49715	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:39.760374069 CET	49716	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:39.930592060 CET	12377	49716	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:39.930670023 CET	49716	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:39.969990015 CET	49716	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:40.101031065 CET	12377	49716	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:40.103101969 CET	49716	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:40.140036106 CET	12377	49716	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:40.273456097 CET	12377	49716	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:42.119734049 CET	49717	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:42.288837910 CET	12377	49717	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:42.288909912 CET	49717	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:42.325723886 CET	49717	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:42.458419085 CET	12377	49717	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:42.458544016 CET	49717	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:42.494827032 CET	12377	49717	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:42.627504110 CET	12377	49717	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:44.463789940 CET	49718	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:44.633935928 CET	12377	49718	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:44.634110928 CET	49718	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:44.690325975 CET	49718	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:44.805500984 CET	12377	49718	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:44.805686951 CET	49718	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:44.860454082 CET	12377	49718	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:44.975954056 CET	12377	49718	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:46.807842970 CET	49719	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:46.977978945 CET	12377	49719	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:46.978104115 CET	49719	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:47.014621973 CET	49719	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:47.149971962 CET	12377	49719	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:47.150084019 CET	49719	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:47.186427116 CET	12377	49719	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:47.320837021 CET	12377	49719	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:49.289314032 CET	49720	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:49.458981991 CET	12377	49720	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:49.459136963 CET	49720	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:49.628827095 CET	12377	49720	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:49.628906965 CET	49720	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:50.231857061 CET	49720	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:50.401299953 CET	12377	49720	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:52.261358976 CET	49721	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:52.431781054 CET	12377	49721	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:52.431968927 CET	49721	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:52.468002081 CET	49721	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:52.602627039 CET	12377	49721	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:52.602685928 CET	49721	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:52.638330936 CET	12377	49721	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:52.773163080 CET	12377	49721	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:54.604234934 CET	49722	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:54.773360968 CET	12377	49722	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:54.773605108 CET	49722	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:54.912029982 CET	49722	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:54.942903996 CET	12377	49722	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:54.943025112 CET	49722	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:55.081233025 CET	12377	49722	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:55.112150908 CET	12377	49722	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:56.823359013 CET	49724	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:56.992508888 CET	12377	49724	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:56.992660046 CET	49724	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:57.050560951 CET	49724	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:57.161915064 CET	12377	49724	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:57.162038088 CET	49724	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:57.219718933 CET	12377	49724	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:57.331180096 CET	12377	49724	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:58.916780949 CET	49726	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:59.089184999 CET	12377	49726	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:59.091546059 CET	49726	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:59.127549887 CET	49726	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:59.261742115 CET	12377	49726	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:59.263951063 CET	49726	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:32:59.297386885 CET	12377	49726	52.28.247.255	192.168.2.7
Mar 20, 2024 11:32:59.433840036 CET	12377	49726	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:00.901314974 CET	49727	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:01.070631027 CET	12377	49727	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:01.072745085 CET	49727	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:01.103230953 CET	49727	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:01.242002964 CET	12377	49727	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:01.242069006 CET	49727	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:01.272434950 CET	12377	49727	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:01.411115885 CET	12377	49727	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:02.760406971 CET	49728	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:02.929563046 CET	12377	49728	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:02.929714918 CET	49728	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:02.967181921 CET	49728	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:03.098969936 CET	12377	49728	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:03.099045038 CET	49728	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:03.136950970 CET	12377	49728	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:03.268321037 CET	12377	49728	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:04.527318954 CET	49729	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:04.696578979 CET	12377	49729	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:04.696695089 CET	49729	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:04.725475073 CET	49729	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:04.866620064 CET	12377	49729	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:04.866699934 CET	49729	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:04.896394968 CET	12377	49729	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:05.036012888 CET	12377	49729	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:06.323631048 CET	49730	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:06.493235111 CET	12377	49730	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:06.493402958 CET	49730	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:06.662858963 CET	12377	49730	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:06.663008928 CET	49730	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:07.239429951 CET	49730	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:07.408796072 CET	12377	49730	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:08.479141951 CET	49731	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:08.655751944 CET	12377	49731	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:08.655940056 CET	49731	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:08.696254969 CET	49731	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:08.829047918 CET	12377	49731	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:08.829127073 CET	49731	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:08.869247913 CET	12377	49731	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:08.999900103 CET	12377	49731	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:09.994936943 CET	49732	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:10.165596008 CET	12377	49732	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:10.169617891 CET	49732	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:10.220691919 CET	49732	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:10.340563059 CET	12377	49732	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:10.341651917 CET	49732	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:10.391375065 CET	12377	49732	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:10.512389898 CET	12377	49732	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:11.432735920 CET	49733	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:11.603579044 CET	12377	49733	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:11.603696108 CET	49733	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:11.632034063 CET	49733	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:11.774719000 CET	12377	49733	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:11.774779081 CET	49733	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:11.802778006 CET	12377	49733	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:11.945455074 CET	12377	49733	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:12.791893005 CET	49734	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:12.962227106 CET	12377	49734	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:12.962352991 CET	49734	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:13.068943024 CET	49734	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:13.132741928 CET	12377	49734	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:13.132924080 CET	49734	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:13.239279032 CET	12377	49734	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:13.303034067 CET	12377	49734	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:14.073968887 CET	49735	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:14.244550943 CET	12377	49735	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:14.244677067 CET	49735	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:14.301538944 CET	49735	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:14.415201902 CET	12377	49735	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:14.415432930 CET	49735	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:14.472578049 CET	12377	49735	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:14.586606026 CET	12377	49735	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:15.291961908 CET	49736	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:15.462713957 CET	12377	49736	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:15.462871075 CET	49736	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:15.497642040 CET	49736	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:15.633897066 CET	12377	49736	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:15.635581017 CET	49736	12377	192.168.2.7	52.28.247.255
Mar 20, 2024 11:33:15.668281078 CET	12377	49736	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:15.806211948 CET	12377	49736	52.28.247.255	192.168.2.7
Mar 20, 2024 11:33:16.555660009 CET	49737	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:16.723359108 CET	12377	49737	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:16.723509073 CET	49737	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:16.758650064 CET	49737	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:16.891510963 CET	12377	49737	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:16.891582966 CET	49737	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:16.926477909 CET	12377	49737	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:17.059387922 CET	12377	49737	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:17.666922092 CET	49738	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:17.834707022 CET	12377	49738	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:17.837547064 CET	49738	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:17.868211031 CET	49738	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:18.005877018 CET	12377	49738	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:18.009560108 CET	49738	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:18.036346912 CET	12377	49738	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:18.177351952 CET	12377	49738	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:18.729455948 CET	49739	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:18.899183989 CET	12377	49739	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:18.899296045 CET	49739	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:18.958942890 CET	49739	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:19.068886042 CET	12377	49739	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:19.069149017 CET	49739	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:19.128390074 CET	12377	49739	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:19.238460064 CET	12377	49739	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:19.745145082 CET	49740	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:19.914138079 CET	12377	49740	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:19.914220095 CET	49740	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:19.971213102 CET	49740	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:20.083141088 CET	12377	49740	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:20.083242893 CET	49740	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:20.139946938 CET	12377	49740	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:20.252336025 CET	12377	49740	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:20.713707924 CET	49741	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:20.881555080 CET	12377	49741	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:20.881659031 CET	49741	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:20.953562021 CET	49741	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:21.049612999 CET	12377	49741	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:21.049704075 CET	49741	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:21.121490002 CET	12377	49741	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:21.217639923 CET	12377	49741	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:21.636046886 CET	49742	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:21.805197954 CET	12377	49742	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:21.805350065 CET	49742	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:21.864562988 CET	49742	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:21.974406958 CET	12377	49742	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:21.974495888 CET	49742	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:22.033391953 CET	12377	49742	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:22.143495083 CET	12377	49742	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:22.537409067 CET	49743	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:22.705183983 CET	12377	49743	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:22.705550909 CET	49743	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:22.873568058 CET	12377	49743	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:22.877523899 CET	49743	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:24.166404009 CET	49743	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:24.334216118 CET	12377	49743	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:24.683861971 CET	49744	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:24.852837086 CET	12377	49744	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:24.853007078 CET	49744	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:24.928788900 CET	49744	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:25.021935940 CET	12377	49744	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:25.022001982 CET	49744	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:25.097441912 CET	12377	49744	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:25.190747976 CET	12377	49744	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:25.495069027 CET	49745	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:25.662847042 CET	12377	49745	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:25.665554047 CET	49745	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:25.695398092 CET	49745	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:25.833300114 CET	12377	49745	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:25.833534002 CET	49745	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:25.862984896 CET	12377	49745	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:26.001076937 CET	12377	49745	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:26.276581049 CET	49746	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:26.448889017 CET	12377	49746	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:26.449525118 CET	49746	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:26.480864048 CET	49746	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:26.619832039 CET	12377	49746	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:26.619976044 CET	49746	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:26.651006937 CET	12377	49746	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:26.791939020 CET	12377	49746	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:27.042483091 CET	49747	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:27.212819099 CET	12377	49747	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:27.212984085 CET	49747	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:27.273761034 CET	49747	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:27.383362055 CET	12377	49747	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:27.383485079 CET	49747	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:27.444335938 CET	12377	49747	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:27.553585052 CET	12377	49747	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:27.777127981 CET	49748	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:27.946890116 CET	12377	49748	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:27.947010994 CET	49748	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:28.024319887 CET	49748	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:28.117141962 CET	12377	49748	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:28.117218018 CET	49748	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:28.193942070 CET	12377	49748	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:28.287065983 CET	12377	49748	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:28.479732990 CET	49749	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:28.649097919 CET	12377	49749	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:28.649619102 CET	49749	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:28.679104090 CET	49749	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:28.818944931 CET	12377	49749	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:28.821557045 CET	49749	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:28.848334074 CET	12377	49749	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:28.992722988 CET	12377	49749	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:29.167578936 CET	49750	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:29.337815046 CET	12377	49750	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:29.337919950 CET	49750	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:29.374696016 CET	49750	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:29.508425951 CET	12377	49750	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:29.509612083 CET	49750	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:29.544976950 CET	12377	49750	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:29.679774046 CET	12377	49750	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:29.823426962 CET	49751	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:29.993639946 CET	12377	49751	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:29.993738890 CET	49751	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:30.046081066 CET	49751	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:30.163990021 CET	12377	49751	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:30.165513039 CET	49751	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:30.216232061 CET	12377	49751	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:30.335807085 CET	12377	49751	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:30.463681936 CET	49752	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:30.633582115 CET	12377	49752	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:30.633662939 CET	49752	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:30.732965946 CET	49752	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:30.803626060 CET	12377	49752	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:30.803868055 CET	49752	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:30.902626991 CET	12377	49752	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:30.973423958 CET	12377	49752	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:31.089850903 CET	49753	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:31.258678913 CET	12377	49753	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:31.258816957 CET	49753	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:31.288801908 CET	49753	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:31.427654982 CET	12377	49753	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:31.427747011 CET	49753	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:31.457525015 CET	12377	49753	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:31.596391916 CET	12377	49753	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:31.682526112 CET	49754	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:31.851551056 CET	12377	49754	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:31.853769064 CET	49754	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:31.884427071 CET	49754	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:32.023058891 CET	12377	49754	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:32.023149967 CET	49754	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:32.053335905 CET	12377	49754	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:32.192007065 CET	12377	49754	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:32.261579037 CET	49755	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:32.429728031 CET	12377	49755	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:32.431561947 CET	49755	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:32.461421967 CET	49755	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:32.599737883 CET	12377	49755	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:32.601620913 CET	49755	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:32.629348040 CET	12377	49755	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:32.770185947 CET	12377	49755	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:32.823137045 CET	49756	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:32.993264914 CET	12377	49756	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:32.993385077 CET	49756	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:33.031970978 CET	49756	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:33.163563013 CET	12377	49756	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:33.163659096 CET	49756	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:33.201999903 CET	12377	49756	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:33.333694935 CET	12377	49756	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:33.385720015 CET	49757	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:33.553972006 CET	12377	49757	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:33.557557106 CET	49757	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:33.599697113 CET	49757	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:33.725719929 CET	12377	49757	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:33.728276968 CET	49757	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:33.767663956 CET	12377	49757	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:33.896384001 CET	12377	49757	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:33.932934999 CET	49758	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:34.100946903 CET	12377	49758	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:34.101033926 CET	49758	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:34.195220947 CET	49758	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:34.270593882 CET	12377	49758	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:34.270690918 CET	49758	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:34.363282919 CET	12377	49758	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:34.439246893 CET	12377	49758	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:34.464587927 CET	49759	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:34.634135962 CET	12377	49759	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:34.637521029 CET	49759	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:34.678105116 CET	49759	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:34.806873083 CET	12377	49759	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:34.809540987 CET	49759	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:34.847018003 CET	12377	49759	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:34.978266001 CET	49759	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:34.978812933 CET	12377	49759	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:34.979392052 CET	49760	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.148672104 CET	12377	49759	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:35.148902893 CET	12377	49760	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:35.148988008 CET	49760	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.196346045 CET	49760	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.317765951 CET	12377	49760	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:35.317831993 CET	49760	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.364871025 CET	12377	49760	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:35.478226900 CET	49760	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.479249001 CET	49761	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.486135960 CET	12377	49760	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:35.647419930 CET	12377	49760	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:35.649198055 CET	12377	49761	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:35.649291039 CET	49761	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.696646929 CET	49761	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.820056915 CET	12377	49761	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:35.821563005 CET	49761	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.865551949 CET	12377	49761	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:35.978347063 CET	49761	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.980108023 CET	49762	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:35.990426064 CET	12377	49761	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.147351027 CET	12377	49761	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.147787094 CET	12377	49762	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.147876024 CET	49762	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.241858006 CET	49762	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.316015959 CET	12377	49762	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.316092968 CET	49762	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.409768105 CET	12377	49762	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.462652922 CET	49762	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.463625908 CET	49763	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.483928919 CET	12377	49762	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.630583048 CET	12377	49762	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.631242990 CET	12377	49763	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.631392002 CET	49763	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.708504915 CET	49763	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.799056053 CET	12377	49763	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.799129963 CET	49763	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.876221895 CET	12377	49763	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:36.931375027 CET	49763	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.932409048 CET	49764	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:36.966559887 CET	12377	49763	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.098706961 CET	12377	49763	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.101295948 CET	12377	49764	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.101387978 CET	49764	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.145984888 CET	49764	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.270401001 CET	12377	49764	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.270478964 CET	49764	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.315217018 CET	12377	49764	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.400428057 CET	49764	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.401494026 CET	49765	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.439419031 CET	12377	49764	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.569375038 CET	12377	49764	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.571633101 CET	12377	49765	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.571747065 CET	49765	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.609991074 CET	49765	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.742093086 CET	12377	49765	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.745547056 CET	49765	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.780077934 CET	12377	49765	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:37.868920088 CET	49765	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.869924068 CET	49766	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:37.915642977 CET	12377	49765	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.038975000 CET	12377	49765	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.039501905 CET	12377	49766	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.039597034 CET	49766	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.185703039 CET	49766	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.209392071 CET	12377	49766	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.209459066 CET	49766	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.323834896 CET	49766	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.326040030 CET	49767	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.355678082 CET	12377	49766	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.379736900 CET	12377	49766	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.494189978 CET	12377	49766	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.496052980 CET	12377	49767	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.496135950 CET	49767	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.618293047 CET	49767	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.666955948 CET	12377	49767	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.669492960 CET	49767	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.775227070 CET	49767	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.776355028 CET	49768	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.789695024 CET	12377	49767	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.840369940 CET	12377	49767	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.945313931 CET	12377	49768	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.945540905 CET	49768	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:38.945684910 CET	12377	49767	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:38.997241974 CET	49768	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:39.114464045 CET	12377	49768	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:39.114538908 CET	49768	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:39.166060925 CET	12377	49768	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:39.212964058 CET	49768	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:39.216057062 CET	49769	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:39.283449888 CET	12377	49768	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:39.381870985 CET	12377	49768	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:39.385864019 CET	12377	49769	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:39.389518976 CET	49769	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:39.559705019 CET	12377	49769	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:39.559752941 CET	49769	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:41.351979971 CET	49769	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:41.447376966 CET	49769	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:41.448328018 CET	49770	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:41.522197008 CET	12377	49769	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:41.617265940 CET	12377	49769	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:41.618015051 CET	12377	49770	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:41.618112087 CET	49770	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:41.667433023 CET	49770	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:41.788007975 CET	12377	49770	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:41.788286924 CET	49770	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:41.837013006 CET	12377	49770	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:41.869272947 CET	49770	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:41.870287895 CET	49771	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:41.957967997 CET	12377	49770	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.039056063 CET	12377	49770	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.039263964 CET	12377	49771	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.039349079 CET	49771	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.101778030 CET	49771	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.208450079 CET	12377	49771	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.208574057 CET	49771	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.270540953 CET	12377	49771	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.290786982 CET	49771	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.291960955 CET	49772	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.377538919 CET	12377	49771	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.459434986 CET	12377	49772	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.459491014 CET	12377	49771	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.459522009 CET	49772	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.531477928 CET	49772	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.627144098 CET	12377	49772	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.629548073 CET	49772	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.698925972 CET	12377	49772	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.712702990 CET	49772	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.713644028 CET	49773	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.797240973 CET	12377	49772	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.880002022 CET	12377	49772	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.881160021 CET	12377	49773	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:42.881258011 CET	49773	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:42.942790031 CET	49773	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.048942089 CET	12377	49773	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.049107075 CET	49773	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.110292912 CET	12377	49773	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.119400024 CET	49773	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.120418072 CET	49774	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.216618061 CET	12377	49773	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.287720919 CET	12377	49773	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.288120985 CET	12377	49774	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.288244963 CET	49774	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.355118990 CET	49774	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.457151890 CET	12377	49774	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.457259893 CET	49774	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.523184061 CET	12377	49774	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.525379896 CET	49774	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.526302099 CET	49775	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.625312090 CET	12377	49774	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.693094969 CET	12377	49774	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.696613073 CET	12377	49775	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.696680069 CET	49775	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.752378941 CET	49775	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.866827011 CET	12377	49775	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.866939068 CET	49775	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.922254086 CET	12377	49775	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:43.931591034 CET	49775	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:43.932595015 CET	49776	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.036881924 CET	12377	49775	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.101517916 CET	12377	49775	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.102341890 CET	12377	49776	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.102406025 CET	49776	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.272485018 CET	12377	49776	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.272533894 CET	49776	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.320991039 CET	49776	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.385003090 CET	49776	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.387049913 CET	49777	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.490864992 CET	12377	49776	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.556005001 CET	12377	49776	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.557252884 CET	12377	49777	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.557337046 CET	49777	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.598423004 CET	49777	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.727503061 CET	12377	49777	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.729511023 CET	49777	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.768383980 CET	12377	49777	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.790757895 CET	49777	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.791747093 CET	49778	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:44.899508953 CET	12377	49777	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.960715055 CET	12377	49778	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.960763931 CET	12377	49777	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:44.960855961 CET	49778	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.026473045 CET	49778	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.130000114 CET	12377	49778	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.130083084 CET	49778	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.185730934 CET	49778	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.186779976 CET	49779	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.195400953 CET	12377	49778	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.300817013 CET	12377	49778	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.354959011 CET	12377	49778	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.355426073 CET	12377	49779	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.355513096 CET	49779	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.463654995 CET	49779	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.526181936 CET	12377	49779	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.526314020 CET	49779	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.572360992 CET	49779	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.573496103 CET	49780	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.636631012 CET	12377	49779	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.698899031 CET	12377	49779	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.740942001 CET	12377	49779	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.740974903 CET	12377	49780	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.741086006 CET	49780	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.809585094 CET	49780	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.909003019 CET	12377	49780	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:45.909070969 CET	49780	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.962718010 CET	49780	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.963829041 CET	49781	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:45.977145910 CET	12377	49780	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.076766014 CET	12377	49780	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.130382061 CET	12377	49780	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.133723021 CET	12377	49781	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.133810997 CET	49781	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.184170961 CET	49781	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.303754091 CET	12377	49781	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.303844929 CET	49781	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.354074955 CET	49781	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.354284048 CET	12377	49781	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.363934040 CET	49782	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.473546028 CET	12377	49781	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.523765087 CET	12377	49781	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.533195019 CET	12377	49782	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.533332109 CET	49782	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.570417881 CET	49782	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.702745914 CET	12377	49782	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.705518961 CET	49782	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.739552021 CET	12377	49782	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.744220972 CET	49782	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.745369911 CET	49783	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.874644995 CET	12377	49782	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.913181067 CET	12377	49783	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.913306952 CET	12377	49782	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:46.913568974 CET	49783	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:46.950087070 CET	49783	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.081482887 CET	12377	49783	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.081579924 CET	49783	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.117705107 CET	12377	49783	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.119057894 CET	49783	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.120119095 CET	49784	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.249259949 CET	12377	49783	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.286556005 CET	12377	49783	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.287930012 CET	12377	49784	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.289532900 CET	49784	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.326374054 CET	49784	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.457628012 CET	12377	49784	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.457797050 CET	49784	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.493922949 CET	49784	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.494211912 CET	12377	49784	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.494849920 CET	49785	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.625730991 CET	12377	49784	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.661715984 CET	12377	49784	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.664319038 CET	12377	49785	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.664455891 CET	49785	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.770524025 CET	49785	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.834212065 CET	12377	49785	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:47.834278107 CET	49785	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.868932962 CET	49785	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.870435953 CET	49786	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:47.940321922 CET	12377	49785	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.003784895 CET	12377	49785	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.038614035 CET	12377	49785	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.040049076 CET	12377	49786	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.040123940 CET	49786	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.139467955 CET	49786	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.210139990 CET	12377	49786	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.210226059 CET	49786	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.243918896 CET	49786	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.245055914 CET	49787	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.309400082 CET	12377	49786	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.379933119 CET	12377	49786	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.413598061 CET	12377	49786	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.414132118 CET	12377	49787	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.414201021 CET	49787	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.452992916 CET	49787	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.583569050 CET	12377	49787	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.585582972 CET	49787	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.618977070 CET	49787	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.620109081 CET	49788	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.622154951 CET	12377	49787	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.754853964 CET	12377	49787	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.788149118 CET	12377	49787	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.790038109 CET	12377	49788	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.793572903 CET	49788	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.834753036 CET	49788	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.963824987 CET	12377	49788	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:48.963917971 CET	49788	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.993957043 CET	49788	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:48.995079041 CET	49789	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.004781008 CET	12377	49788	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.134321928 CET	12377	49788	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.162952900 CET	12377	49789	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.163063049 CET	49789	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.164346933 CET	12377	49788	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.210510015 CET	49789	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.331229925 CET	12377	49789	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.331444979 CET	49789	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.353296995 CET	49789	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.354505062 CET	49790	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.379432917 CET	12377	49789	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.499779940 CET	12377	49789	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.521071911 CET	12377	49789	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.521826029 CET	12377	49790	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.524041891 CET	49790	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.574733973 CET	49790	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.693135977 CET	12377	49790	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.693203926 CET	49790	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.728384972 CET	49790	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.732773066 CET	49791	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.742194891 CET	12377	49790	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.860665083 CET	12377	49790	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.896197081 CET	12377	49790	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.902828932 CET	12377	49791	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:49.902936935 CET	49791	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:49.971132040 CET	49791	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.074081898 CET	12377	49791	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.074219942 CET	49791	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.103401899 CET	49791	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.104862928 CET	49792	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.141555071 CET	12377	49791	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.245182991 CET	12377	49791	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.273639917 CET	12377	49791	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.275665998 CET	12377	49792	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.275751114 CET	49792	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.346470118 CET	49792	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.447444916 CET	12377	49792	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.447510004 CET	49792	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.478364944 CET	49792	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.480232954 CET	49793	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.516757965 CET	12377	49792	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.617614031 CET	12377	49792	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.647557020 CET	12377	49793	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.647773027 CET	49793	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.648468971 CET	12377	49792	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.684828997 CET	49793	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.815324068 CET	12377	49793	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.815511942 CET	49793	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.838890076 CET	49793	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.838970900 CET	49794	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:50.852134943 CET	12377	49793	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:50.982898951 CET	12377	49793	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.006324053 CET	12377	49793	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.006899118 CET	12377	49794	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.007065058 CET	49794	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.071863890 CET	49794	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.175055981 CET	12377	49794	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.175229073 CET	49794	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.197942972 CET	49794	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.199064016 CET	49795	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.242304087 CET	12377	49794	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.343028069 CET	12377	49794	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.365722895 CET	12377	49794	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.366323948 CET	12377	49795	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.366498947 CET	49795	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.444410086 CET	49795	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.534033060 CET	12377	49795	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.537857056 CET	49795	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.556469917 CET	49795	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.561469078 CET	49796	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.611768961 CET	12377	49795	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.705121994 CET	12377	49795	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.723671913 CET	12377	49795	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.730293036 CET	12377	49796	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.730360031 CET	49796	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.822453022 CET	49796	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.899635077 CET	12377	49796	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:51.899708986 CET	49796	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.918545008 CET	49796	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.920907974 CET	49797	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:51.991540909 CET	12377	49796	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.068675995 CET	12377	49796	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.087661982 CET	12377	49796	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.090243101 CET	12377	49797	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.090312958 CET	49797	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.176985979 CET	49797	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.260045052 CET	12377	49797	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.260153055 CET	49797	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.275182009 CET	49797	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.276321888 CET	49798	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.346225023 CET	12377	49797	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.429198980 CET	12377	49797	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.444279909 CET	12377	49797	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.446075916 CET	12377	49798	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.446144104 CET	49798	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.607559919 CET	49798	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.616034985 CET	12377	49798	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.616363049 CET	49798	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.634740114 CET	49798	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.637474060 CET	49799	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.777648926 CET	12377	49798	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.786076069 CET	12377	49798	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.804383039 CET	12377	49798	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.806606054 CET	12377	49799	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.806782961 CET	49799	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.847810030 CET	49799	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.975836992 CET	12377	49799	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:52.976007938 CET	49799	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.994898081 CET	49799	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:52.994909048 CET	49800	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.017890930 CET	12377	49799	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.145020962 CET	12377	49799	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.163871050 CET	12377	49800	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.163889885 CET	12377	49799	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.164057016 CET	49800	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.233467102 CET	49800	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.332994938 CET	12377	49800	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.333095074 CET	49800	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.353307009 CET	49800	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.357621908 CET	49801	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.402230978 CET	12377	49800	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.502120018 CET	12377	49800	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.522074938 CET	12377	49800	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.525296926 CET	12377	49801	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.525463104 CET	49801	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.623385906 CET	49801	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.693556070 CET	12377	49801	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.693624020 CET	49801	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.712748051 CET	49801	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.724998951 CET	49802	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:53.791198015 CET	12377	49801	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.861447096 CET	12377	49801	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.880438089 CET	12377	49801	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.893371105 CET	12377	49802	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:53.893440962 CET	49802	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.021313906 CET	49802	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.061374903 CET	12377	49802	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.061458111 CET	49802	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.073894978 CET	49802	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.075025082 CET	49803	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.189183950 CET	12377	49802	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.229234934 CET	12377	49802	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.242988110 CET	12377	49802	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.244992971 CET	12377	49803	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.245075941 CET	49803	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.329758883 CET	49803	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.414835930 CET	12377	49803	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.414926052 CET	49803	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.431533098 CET	49803	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.433336973 CET	49804	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.498918056 CET	12377	49803	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.583725929 CET	12377	49803	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.600861073 CET	12377	49803	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.603255987 CET	12377	49804	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.603348017 CET	49804	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.697469950 CET	49804	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.773629904 CET	12377	49804	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.773871899 CET	49804	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.791800022 CET	49804	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.791802883 CET	49805	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.868267059 CET	12377	49804	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.943661928 CET	12377	49804	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.959568977 CET	12377	49805	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:54.959709883 CET	49805	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:54.961529016 CET	12377	49804	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.001791000 CET	49805	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.127428055 CET	12377	49805	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.128829956 CET	49805	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.150193930 CET	49805	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.151339054 CET	49806	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.169342041 CET	12377	49805	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.296329021 CET	12377	49805	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.317677975 CET	12377	49805	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.319087982 CET	12377	49806	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.319201946 CET	49806	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.360543013 CET	49806	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.487158060 CET	12377	49806	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.487252951 CET	49806	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.509717941 CET	49806	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.511029959 CET	49807	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.528459072 CET	12377	49806	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.655107975 CET	12377	49806	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.677597046 CET	12377	49806	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.680206060 CET	12377	49807	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.680298090 CET	49807	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.760586977 CET	49807	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.849513054 CET	12377	49807	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:55.849569082 CET	49807	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.872422934 CET	49807	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.873482943 CET	49808	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:55.929676056 CET	12377	49807	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.018914938 CET	12377	49807	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.041737080 CET	12377	49807	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.043472052 CET	12377	49808	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.043539047 CET	49808	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:56.085479021 CET	49808	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:56.213737965 CET	12377	49808	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.213813066 CET	49808	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:56.228364944 CET	49808	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:56.229518890 CET	49809	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:56.255466938 CET	12377	49808	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.383903027 CET	12377	49808	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.398328066 CET	12377	49808	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.399357080 CET	12377	49809	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.399420977 CET	49809	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:56.569545984 CET	12377	49809	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:56.569600105 CET	49809	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.298563957 CET	49809	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.306823015 CET	49809	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.308238029 CET	49810	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.468563080 CET	12377	49809	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:58.476727009 CET	12377	49809	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:58.478146076 CET	12377	49810	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:58.478313923 CET	49810	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.523247004 CET	49810	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.648668051 CET	12377	49810	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:58.648824930 CET	49810	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.665890932 CET	49810	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.666939974 CET	49811	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.693281889 CET	12377	49810	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:58.819596052 CET	12377	49810	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:58.834481001 CET	12377	49811	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:58.834611893 CET	49811	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:58.838224888 CET	12377	49810	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:58.895531893 CET	49811	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.002412081 CET	12377	49811	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.002577066 CET	49811	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.009577036 CET	49811	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.010665894 CET	49812	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.063183069 CET	12377	49811	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.170449018 CET	12377	49811	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.177475929 CET	12377	49811	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.178498983 CET	12377	49812	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.178560972 CET	49812	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.241662979 CET	49812	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.346457005 CET	12377	49812	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.346517086 CET	49812	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.353338003 CET	49812	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.354449034 CET	49813	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.412290096 CET	12377	49812	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.514287949 CET	12377	49812	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.520970106 CET	12377	49812	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.521967888 CET	12377	49813	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.522043943 CET	49813	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.635835886 CET	49813	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.689766884 CET	12377	49813	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.693578005 CET	49813	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.712749958 CET	49813	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.713728905 CET	49814	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.803556919 CET	12377	49813	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.861193895 CET	12377	49813	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.880513906 CET	12377	49813	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.881366014 CET	12377	49814	3.68.171.119	192.168.2.7
Mar 20, 2024 11:33:59.881539106 CET	49814	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:33:59.921446085 CET	49814	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.049293041 CET	12377	49814	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.049556971 CET	49814	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.056617022 CET	49814	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.057643890 CET	49815	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.089176893 CET	12377	49814	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.217101097 CET	12377	49814	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.224102974 CET	12377	49814	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.226267099 CET	12377	49815	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.226332903 CET	49815	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.276611090 CET	49815	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.395169973 CET	12377	49815	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.395328999 CET	49815	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.400187016 CET	49815	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.401345968 CET	49816	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.445347071 CET	12377	49815	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.564073086 CET	12377	49815	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.568821907 CET	12377	49815	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.570070982 CET	12377	49816	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.570142984 CET	49816	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.620156050 CET	49816	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.739312887 CET	12377	49816	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.739618063 CET	49816	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.744247913 CET	49816	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.745023012 CET	49817	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.788969994 CET	12377	49816	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.908483028 CET	12377	49816	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.912395000 CET	12377	49817	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.912537098 CET	49817	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:00.912925959 CET	12377	49816	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:00.980673075 CET	49817	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.080167055 CET	12377	49817	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.080240011 CET	49817	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.087707996 CET	49817	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.088824987 CET	49818	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.148111105 CET	12377	49817	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.247728109 CET	12377	49817	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.255090952 CET	12377	49817	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.258089066 CET	12377	49818	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.258163929 CET	49818	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.308037996 CET	49818	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.427326918 CET	12377	49818	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.427403927 CET	49818	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.431428909 CET	49818	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.432529926 CET	49819	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.476995945 CET	12377	49818	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.596358061 CET	12377	49818	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.600312948 CET	12377	49818	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.602092981 CET	12377	49819	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.602173090 CET	49819	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.691543102 CET	49819	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.772192955 CET	12377	49819	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.772288084 CET	49819	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.790976048 CET	49819	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.792512894 CET	49820	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.861471891 CET	12377	49819	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.942030907 CET	12377	49819	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.959938049 CET	12377	49820	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:01.960038900 CET	49820	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:01.960668087 CET	12377	49819	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:02.032445908 CET	49820	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:02.128103971 CET	12377	49820	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:02.128237963 CET	49820	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:02.134614944 CET	49820	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:02.135863066 CET	49821	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:02.200721979 CET	12377	49820	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:02.296952963 CET	12377	49820	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:02.302295923 CET	12377	49820	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:02.307012081 CET	12377	49821	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:02.307090044 CET	49821	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:02.477376938 CET	12377	49821	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:02.477454901 CET	49821	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.300697088 CET	49821	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.306679010 CET	49821	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.308310986 CET	49822	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.470838070 CET	12377	49821	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:03.476492882 CET	12377	49821	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:03.477262020 CET	12377	49822	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:03.477344036 CET	49822	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.516593933 CET	49822	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.646716118 CET	12377	49822	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:03.646778107 CET	49822	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.650191069 CET	49822	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.651308060 CET	49823	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.685507059 CET	12377	49822	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:03.815824986 CET	12377	49822	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:03.819062948 CET	12377	49822	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:03.821177959 CET	12377	49823	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:03.821237087 CET	49823	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.920650959 CET	49823	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.991441965 CET	12377	49823	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:03.991503000 CET	49823	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.994070053 CET	49823	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:03.995174885 CET	49824	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.090923071 CET	12377	49823	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.161554098 CET	12377	49823	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.164025068 CET	12377	49823	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.165153027 CET	12377	49824	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.165215015 CET	49824	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.246562958 CET	49824	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.335825920 CET	12377	49824	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.335952044 CET	49824	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.353519917 CET	49824	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.354656935 CET	49825	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.416696072 CET	12377	49824	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.506093979 CET	12377	49824	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.523475885 CET	12377	49824	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.524666071 CET	12377	49825	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.524730921 CET	49825	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.618496895 CET	49825	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.695019960 CET	12377	49825	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.695785046 CET	49825	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.713768005 CET	49825	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.713768959 CET	49826	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.788781881 CET	12377	49825	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.865879059 CET	12377	49825	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.883769035 CET	12377	49825	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.883960009 CET	12377	49826	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:04.884155989 CET	49826	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:04.923866987 CET	49826	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.054584026 CET	12377	49826	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.055948019 CET	49826	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.072124958 CET	49826	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.075642109 CET	49827	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.094060898 CET	12377	49826	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.226171970 CET	12377	49826	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.242281914 CET	12377	49826	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.243026972 CET	12377	49827	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.243637085 CET	49827	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.304929018 CET	49827	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.411082983 CET	12377	49827	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.411175966 CET	49827	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.415875912 CET	49827	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.417478085 CET	49828	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.472282887 CET	12377	49827	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.578423977 CET	12377	49827	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.583058119 CET	12377	49827	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.587306023 CET	12377	49828	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.587826014 CET	49828	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.645733118 CET	49828	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.757838011 CET	12377	49828	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.757931948 CET	49828	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.760977030 CET	49828	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.762151957 CET	49829	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.815588951 CET	12377	49828	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.928277969 CET	12377	49828	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.929568052 CET	12377	49829	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.929714918 CET	49829	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:05.930773020 CET	12377	49828	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:05.990658045 CET	49829	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.097393990 CET	12377	49829	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.097610950 CET	49829	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.103338003 CET	49829	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.104357004 CET	49830	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.158406019 CET	12377	49829	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.265012980 CET	12377	49829	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.270860910 CET	12377	49829	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.273984909 CET	12377	49830	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.274055004 CET	49830	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.441490889 CET	49830	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.443886042 CET	12377	49830	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.443942070 CET	49830	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.447048903 CET	49830	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.448004961 CET	49831	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.611344099 CET	12377	49830	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.613538027 CET	12377	49830	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.616754055 CET	12377	49830	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.618818045 CET	12377	49831	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.618908882 CET	49831	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.694097042 CET	49831	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.791547060 CET	12377	49831	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.791665077 CET	49831	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.806624889 CET	49831	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.807781935 CET	49832	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:06.864187002 CET	12377	49831	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.961605072 CET	12377	49831	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.976464033 CET	12377	49831	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.977615118 CET	12377	49832	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:06.977716923 CET	49832	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.024884939 CET	49832	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.147805929 CET	12377	49832	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.147896051 CET	49832	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.150264978 CET	49832	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.151386976 CET	49833	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.194749117 CET	12377	49832	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.317697048 CET	12377	49832	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.319003105 CET	12377	49833	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.319093943 CET	49833	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.320677042 CET	12377	49832	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.374557018 CET	49833	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.487219095 CET	12377	49833	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.487287998 CET	49833	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.493963957 CET	49833	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.495173931 CET	49834	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.542419910 CET	12377	49833	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.655335903 CET	12377	49833	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.661644936 CET	12377	49833	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.664180040 CET	12377	49834	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.664256096 CET	49834	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.720985889 CET	49834	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.833391905 CET	12377	49834	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:07.833462954 CET	49834	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.837758064 CET	49834	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.838996887 CET	49835	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:07.890180111 CET	12377	49834	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.002495050 CET	12377	49834	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.006709099 CET	12377	49834	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.008816004 CET	12377	49835	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.008971930 CET	49835	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.094835043 CET	49835	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.179048061 CET	12377	49835	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.179737091 CET	49835	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.181463003 CET	49835	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.182465076 CET	49836	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.264656067 CET	12377	49835	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.354465961 CET	12377	49835	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.356173992 CET	12377	49835	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.356935024 CET	12377	49836	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.357003927 CET	49836	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.433985949 CET	49836	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.527192116 CET	12377	49836	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.527270079 CET	49836	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.540853977 CET	49836	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.541901112 CET	49837	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.603885889 CET	12377	49836	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.697293043 CET	12377	49836	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.710958004 CET	12377	49836	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.711070061 CET	12377	49837	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.711143970 CET	49837	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.834908962 CET	49837	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.880664110 CET	12377	49837	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:08.880815983 CET	49837	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.884777069 CET	49837	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:08.885962963 CET	49838	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.004344940 CET	12377	49837	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.050162077 CET	12377	49837	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.053977966 CET	12377	49837	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.055718899 CET	12377	49838	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.055788040 CET	49838	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.131705046 CET	49838	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.225672960 CET	12377	49838	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.228368044 CET	49838	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.244244099 CET	49838	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.245965004 CET	49839	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.301461935 CET	12377	49838	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.398194075 CET	12377	49838	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.414122105 CET	12377	49838	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.416204929 CET	12377	49839	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.416340113 CET	49839	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.503892899 CET	49839	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.586370945 CET	12377	49839	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.586463928 CET	49839	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.603400946 CET	49839	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.604424000 CET	49840	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.673687935 CET	12377	49839	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.756057024 CET	12377	49839	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.771797895 CET	12377	49840	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.771867990 CET	49840	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.773020029 CET	12377	49839	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.845798016 CET	49840	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.939533949 CET	12377	49840	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:09.939627886 CET	49840	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.947078943 CET	49840	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:09.948129892 CET	49841	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.013257980 CET	12377	49840	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.107140064 CET	12377	49840	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.114574909 CET	12377	49840	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.117902040 CET	12377	49841	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.121539116 CET	49841	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.184683084 CET	49841	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.291636944 CET	12377	49841	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.291702032 CET	49841	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.306566954 CET	49841	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.307869911 CET	49842	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.354449034 CET	12377	49841	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.461359024 CET	12377	49841	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.476432085 CET	12377	49841	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.478018045 CET	12377	49842	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.478086948 CET	49842	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.594811916 CET	49842	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.649029970 CET	12377	49842	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.649146080 CET	49842	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.649368048 CET	49842	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.650940895 CET	49843	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.764858961 CET	12377	49842	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.818384886 CET	12377	49843	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.818459034 CET	49843	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.818937063 CET	12377	49842	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.819051981 CET	12377	49842	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.894124031 CET	49843	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.986335993 CET	12377	49843	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:10.986404896 CET	49843	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.986684084 CET	49843	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:10.987740993 CET	49844	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.061666965 CET	12377	49843	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.153744936 CET	12377	49843	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.154303074 CET	12377	49843	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.157424927 CET	12377	49844	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.157573938 CET	49844	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.232381105 CET	49844	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.326899052 CET	12377	49844	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.327006102 CET	49844	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.327162981 CET	49844	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.328293085 CET	49845	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.402621984 CET	12377	49844	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.495784998 CET	12377	49844	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.495832920 CET	12377	49844	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.495960951 CET	12377	49845	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.496030092 CET	49845	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.612348080 CET	49845	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.664011002 CET	12377	49845	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.664099932 CET	49845	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.664243937 CET	49845	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.665365934 CET	49846	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.780298948 CET	12377	49845	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.831979990 CET	12377	49845	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.832005024 CET	12377	49845	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.833015919 CET	12377	49846	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:11.833146095 CET	49846	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:11.920634031 CET	49846	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.001087904 CET	12377	49846	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.001586914 CET	49846	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.002454996 CET	49846	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.003462076 CET	49847	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.088521957 CET	12377	49846	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.169289112 CET	12377	49846	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.170097113 CET	12377	49846	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.172282934 CET	12377	49847	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.172406912 CET	49847	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.312712908 CET	49847	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.341643095 CET	12377	49847	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.341850042 CET	49847	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.342087984 CET	49847	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.343358994 CET	49848	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.481659889 CET	12377	49847	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.510538101 CET	12377	49847	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.510561943 CET	12377	49847	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.513251066 CET	12377	49848	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.513380051 CET	49848	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.624731064 CET	49848	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.683779955 CET	12377	49848	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.683908939 CET	49848	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.684181929 CET	49848	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.685123920 CET	49849	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.794915915 CET	12377	49848	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.852531910 CET	12377	49849	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.852622032 CET	49849	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:12.853990078 CET	12377	49848	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.854733944 CET	12377	49848	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:12.913873911 CET	49849	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.020204067 CET	12377	49849	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.020298004 CET	49849	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.021264076 CET	49849	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.023329973 CET	49850	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.081326008 CET	12377	49849	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.187596083 CET	12377	49849	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.188452005 CET	12377	49849	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.192795038 CET	12377	49850	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.192884922 CET	49850	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.266494036 CET	49850	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.362793922 CET	12377	49850	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.362895012 CET	49850	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.363118887 CET	49850	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.364238977 CET	49851	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.441354990 CET	12377	49850	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.534514904 CET	12377	49850	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.534545898 CET	12377	49850	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.536211014 CET	12377	49851	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.536293030 CET	49851	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.688476086 CET	49851	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.707246065 CET	12377	49851	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.707319021 CET	49851	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.708476067 CET	49851	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.709563017 CET	49852	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.858033895 CET	12377	49851	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.876691103 CET	12377	49851	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.877888918 CET	12377	49851	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.879185915 CET	12377	49852	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:13.879257917 CET	49852	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:13.973933935 CET	49852	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.049585104 CET	12377	49852	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.049650908 CET	49852	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.049884081 CET	49852	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.050976038 CET	49853	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.143764019 CET	12377	49852	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.219624996 CET	12377	49852	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.219649076 CET	12377	49852	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.221230030 CET	12377	49853	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.221302032 CET	49853	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.318067074 CET	49853	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.391633034 CET	12377	49853	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.391700983 CET	49853	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.391865969 CET	49853	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.392944098 CET	49854	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.488495111 CET	12377	49853	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.562098026 CET	12377	49853	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.562122107 CET	12377	49853	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.563076019 CET	12377	49854	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.563154936 CET	49854	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.679888964 CET	49854	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.733510971 CET	12377	49854	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.736020088 CET	49854	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.736020088 CET	49854	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.741516113 CET	49855	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.850125074 CET	12377	49854	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.906380892 CET	12377	49854	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.906404018 CET	12377	49854	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.911393881 CET	12377	49855	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:14.911519051 CET	49855	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:14.987531900 CET	49855	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.081970930 CET	12377	49855	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.083055019 CET	49855	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.083055019 CET	49855	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.084974051 CET	49856	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.157444954 CET	12377	49855	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.252892971 CET	12377	49855	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.252917051 CET	12377	49855	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.253905058 CET	12377	49856	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.255861044 CET	49856	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.373514891 CET	49856	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.425192118 CET	12377	49856	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.425342083 CET	49856	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.425738096 CET	49856	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.426832914 CET	49857	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.542500019 CET	12377	49856	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.594230890 CET	12377	49856	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.594456911 CET	12377	49856	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.595725060 CET	12377	49857	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.596046925 CET	49857	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.714035988 CET	49857	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.765347004 CET	12377	49857	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.765486956 CET	49857	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.765804052 CET	49857	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.766721010 CET	49858	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:15.883174896 CET	12377	49857	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.934617043 CET	12377	49857	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.934643984 CET	12377	49857	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.935852051 CET	12377	49858	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:15.935925007 CET	49858	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.096153021 CET	49858	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.105185986 CET	12377	49858	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.105241060 CET	49858	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.105578899 CET	49858	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.107270002 CET	49859	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.265124083 CET	12377	49858	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.274174929 CET	12377	49858	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.274717093 CET	12377	49858	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.277097940 CET	12377	49859	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.277195930 CET	49859	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.367321014 CET	49859	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.447417021 CET	12377	49859	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.447480917 CET	49859	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.447897911 CET	49859	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.449362993 CET	49860	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.537395954 CET	12377	49859	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.617532969 CET	12377	49859	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.617743969 CET	12377	49859	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.618042946 CET	12377	49860	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.618108988 CET	49860	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.737524986 CET	49860	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.787199020 CET	12377	49860	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.787359953 CET	49860	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.788378000 CET	49860	12377	192.168.2.7	3.68.171.119
Mar 20, 2024 11:34:16.885874033 CET	49861	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:16.906362057 CET	12377	49860	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.956311941 CET	12377	49860	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:16.956892967 CET	12377	49860	3.68.171.119	192.168.2.7
Mar 20, 2024 11:34:17.054670095 CET	12377	49861	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.054851055 CET	49861	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.117522001 CET	49861	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.223709106 CET	12377	49861	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.224031925 CET	49861	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.224695921 CET	49861	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.229547024 CET	49862	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.286355019 CET	12377	49861	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.392669916 CET	12377	49861	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.393198967 CET	12377	49861	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.399519920 CET	12377	49862	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.400008917 CET	49862	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.476281881 CET	49862	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.570200920 CET	12377	49862	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.570298910 CET	49862	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.570492983 CET	49862	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.571968079 CET	49863	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.646965027 CET	12377	49862	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.740284920 CET	12377	49862	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.740309000 CET	12377	49862	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.740528107 CET	12377	49863	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.740605116 CET	49863	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.826009035 CET	49863	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.910015106 CET	12377	49863	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:17.910130978 CET	49863	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.910307884 CET	49863	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.912067890 CET	49864	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:17.994774103 CET	12377	49863	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.078916073 CET	12377	49863	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.079202890 CET	12377	49863	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.082287073 CET	12377	49864	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.082372904 CET	49864	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.142755985 CET	49864	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.253581047 CET	12377	49864	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.253659010 CET	49864	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.253931046 CET	49864	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.255322933 CET	49865	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.312982082 CET	12377	49864	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.423573017 CET	12377	49864	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.423904896 CET	12377	49865	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.423968077 CET	49865	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.424345970 CET	12377	49864	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.500137091 CET	49865	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.592847109 CET	12377	49865	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.592911005 CET	49865	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.593318939 CET	49865	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.594871998 CET	49866	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.668824911 CET	12377	49865	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.761487007 CET	12377	49865	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.761714935 CET	12377	49865	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.763407946 CET	12377	49866	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.763499022 CET	49866	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.837574005 CET	49866	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.932565928 CET	12377	49866	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:18.933885098 CET	49866	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.933885098 CET	49866	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:18.937536001 CET	49867	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.006441116 CET	12377	49866	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.102610111 CET	12377	49866	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.102663994 CET	12377	49866	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.107104063 CET	12377	49867	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.107410908 CET	49867	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.154412031 CET	49867	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.277261019 CET	12377	49867	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.277465105 CET	49867	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.277587891 CET	49867	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.278732061 CET	49868	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.324117899 CET	12377	49867	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.449413061 CET	12377	49867	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.449433088 CET	12377	49867	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.449449062 CET	12377	49868	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.449558973 CET	49868	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.490073919 CET	49868	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.619750023 CET	12377	49868	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.619853973 CET	49868	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.620812893 CET	49868	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.621721029 CET	49869	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.660073042 CET	12377	49868	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.789112091 CET	12377	49869	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.789175987 CET	49869	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.789680958 CET	12377	49868	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.790494919 CET	12377	49868	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.929064035 CET	49869	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.956708908 CET	12377	49869	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:19.956784964 CET	49869	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.957020044 CET	49869	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:19.958887100 CET	49870	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.096385002 CET	12377	49869	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.124113083 CET	12377	49869	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.124205112 CET	12377	49869	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.126329899 CET	12377	49870	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.126425028 CET	49870	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.191576004 CET	49870	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.297429085 CET	12377	49870	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.297605038 CET	49870	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.297801971 CET	49870	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.298841000 CET	49871	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.359016895 CET	12377	49870	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.465033054 CET	12377	49870	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.465059996 CET	12377	49870	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.466165066 CET	12377	49871	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.466243982 CET	49871	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.549165010 CET	49871	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.634108067 CET	12377	49871	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.634186029 CET	49871	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.634645939 CET	49871	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.636384010 CET	49872	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.716646910 CET	12377	49871	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.801574945 CET	12377	49871	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.801759958 CET	12377	49871	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.804255962 CET	12377	49872	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.805005074 CET	49872	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.872855902 CET	49872	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.973012924 CET	12377	49872	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:20.973531961 CET	49872	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.973678112 CET	49872	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:20.975575924 CET	49873	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.041872025 CET	12377	49872	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.141514063 CET	12377	49872	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.141571999 CET	12377	49872	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.144301891 CET	12377	49873	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.145946980 CET	49873	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.195128918 CET	49873	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.315181971 CET	12377	49873	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.315500975 CET	49873	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.315583944 CET	49873	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.316519022 CET	49874	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.364352942 CET	12377	49873	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.484358072 CET	12377	49873	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.484383106 CET	12377	49873	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.485188007 CET	12377	49874	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.487117052 CET	49874	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.533524036 CET	49874	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.656155109 CET	12377	49874	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.656234026 CET	49874	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.656497002 CET	49874	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.658369064 CET	49875	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.702275991 CET	12377	49874	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.825193882 CET	12377	49874	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.825248003 CET	12377	49874	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.827609062 CET	12377	49875	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.827745914 CET	49875	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.990200043 CET	49875	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.997203112 CET	12377	49875	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:21.997262955 CET	49875	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.997410059 CET	49875	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:21.998223066 CET	49876	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.159461021 CET	12377	49875	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.165491104 CET	12377	49876	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.165571928 CET	49876	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.166467905 CET	12377	49875	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.167180061 CET	12377	49875	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.286075115 CET	49876	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.333427906 CET	12377	49876	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.333559990 CET	49876	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.333811998 CET	49876	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.335467100 CET	49877	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.453939915 CET	12377	49876	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.501316071 CET	12377	49876	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.501354933 CET	12377	49876	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.504398108 CET	12377	49877	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.504479885 CET	49877	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.610549927 CET	49877	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.673667908 CET	12377	49877	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.673903942 CET	49877	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.674231052 CET	49877	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.675653934 CET	49878	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.779812098 CET	12377	49877	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.843543053 CET	12377	49877	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.843936920 CET	12377	49877	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.846159935 CET	12377	49878	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:22.847666979 CET	49878	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:22.955429077 CET	49878	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.017689943 CET	12377	49878	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.019824028 CET	49878	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.020689964 CET	49878	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.023621082 CET	49879	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.126020908 CET	12377	49878	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.192924023 CET	12377	49878	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.193706989 CET	12377	49878	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.193725109 CET	12377	49879	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.193830967 CET	49879	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.243717909 CET	49879	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.362945080 CET	12377	49879	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.363354921 CET	49879	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.363503933 CET	49879	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.367686987 CET	49880	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.412790060 CET	12377	49879	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.535593033 CET	12377	49879	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.535609007 CET	12377	49879	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.540124893 CET	12377	49880	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.543179989 CET	49880	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.609925032 CET	49880	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.710769892 CET	12377	49880	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.710844994 CET	49880	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.711097002 CET	49880	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.713004112 CET	49881	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:23.777446985 CET	12377	49880	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.878317118 CET	12377	49880	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.878344059 CET	12377	49880	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.883960009 CET	12377	49881	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:23.884035110 CET	49881	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.002154112 CET	49881	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.054800034 CET	12377	49881	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.054883957 CET	49881	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.059904099 CET	49881	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.061330080 CET	49882	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.173497915 CET	12377	49881	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.224812984 CET	12377	49881	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.229701996 CET	12377	49881	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.230277061 CET	12377	49882	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.230355978 CET	49882	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.335536003 CET	49882	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.399406910 CET	12377	49882	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.399473906 CET	49882	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.399672985 CET	49882	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.400778055 CET	49883	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.504302979 CET	12377	49882	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.568188906 CET	12377	49882	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.568305016 CET	12377	49882	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.570904016 CET	12377	49883	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.570990086 CET	49883	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.660852909 CET	49883	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.742537022 CET	12377	49883	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.743083000 CET	49883	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.743377924 CET	49883	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.744692087 CET	49884	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:24.831399918 CET	12377	49883	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.913340092 CET	12377	49883	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.913594007 CET	12377	49883	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.913611889 CET	12377	49884	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:24.913793087 CET	49884	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.016108990 CET	49884	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.086441994 CET	12377	49884	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.090558052 CET	49884	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.090558052 CET	49884	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.093519926 CET	49885	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.185096025 CET	12377	49884	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.259591103 CET	12377	49884	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.259605885 CET	12377	49884	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.263281107 CET	12377	49885	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.263395071 CET	49885	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.329687119 CET	49885	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.433345079 CET	12377	49885	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.433516979 CET	49885	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.435131073 CET	49886	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.435132027 CET	49885	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.499444008 CET	12377	49885	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.603292942 CET	12377	49885	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.603960037 CET	12377	49886	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.604043007 CET	49886	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.604938984 CET	12377	49885	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.684915066 CET	49886	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.773092985 CET	12377	49886	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.773174047 CET	49886	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.773488998 CET	49886	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.774358988 CET	49887	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:25.853677034 CET	12377	49886	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.941881895 CET	12377	49886	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.941935062 CET	12377	49886	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.943826914 CET	12377	49887	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:25.943901062 CET	49887	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.066165924 CET	49887	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.113554001 CET	12377	49887	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.113620043 CET	49887	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.113926888 CET	49887	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.115140915 CET	49888	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.235753059 CET	12377	49887	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.283329964 CET	12377	49887	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.283349037 CET	12377	49887	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.285063982 CET	12377	49888	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.285147905 CET	49888	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.355629921 CET	49888	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.455107927 CET	12377	49888	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.455187082 CET	49888	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.455403090 CET	49888	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.456458092 CET	49889	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.525562048 CET	12377	49888	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.623835087 CET	12377	49889	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.623918056 CET	49889	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.624829054 CET	12377	49888	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.624972105 CET	12377	49888	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.727559090 CET	49889	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.791585922 CET	12377	49889	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.791776896 CET	49889	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.793648005 CET	49890	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.793651104 CET	49889	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:26.895101070 CET	12377	49889	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.959265947 CET	12377	49889	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.960949898 CET	12377	49889	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.964071989 CET	12377	49890	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:26.964204073 CET	49890	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.075717926 CET	49890	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.134593010 CET	12377	49890	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.135561943 CET	49890	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.135811090 CET	49890	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.137609005 CET	49891	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.245989084 CET	12377	49890	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.305305004 CET	12377	49891	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.305419922 CET	49891	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.305712938 CET	12377	49890	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.305841923 CET	12377	49890	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.372641087 CET	49891	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.473284960 CET	12377	49891	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.473433971 CET	49891	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.473552942 CET	49891	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.477514029 CET	49892	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.540174007 CET	12377	49891	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.640974998 CET	12377	49891	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.640993118 CET	12377	49891	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.647224903 CET	12377	49892	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.647444963 CET	49892	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.726262093 CET	49892	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.817425013 CET	12377	49892	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.817488909 CET	49892	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.817703962 CET	49892	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.819137096 CET	49893	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:27.896361113 CET	12377	49892	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.987339973 CET	12377	49892	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.987468958 CET	12377	49892	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.988723040 CET	12377	49893	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:27.988789082 CET	49893	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:28.113362074 CET	49893	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:28.159009933 CET	12377	49893	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:28.159117937 CET	49893	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:28.159888029 CET	49893	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:28.160734892 CET	49894	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:28.282998085 CET	12377	49893	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:28.328783989 CET	12377	49893	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:28.329503059 CET	12377	49893	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:28.329521894 CET	12377	49894	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:28.329580069 CET	49894	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:28.498533964 CET	12377	49894	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:28.498610020 CET	49894	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:29.055490971 CET	49894	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:29.145241022 CET	49894	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:29.147095919 CET	49895	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:29.224123955 CET	12377	49894	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:29.316787004 CET	12377	49894	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:29.316814899 CET	12377	49895	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:29.324044943 CET	49895	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:29.492132902 CET	12377	49895	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:29.493633032 CET	49895	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.192507982 CET	49895	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.194905043 CET	49895	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.196129084 CET	49896	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.360297918 CET	12377	49895	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:30.362473011 CET	12377	49895	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:30.365667105 CET	12377	49896	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:30.365744114 CET	49896	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.406758070 CET	49896	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.535514116 CET	12377	49896	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:30.535583019 CET	49896	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.535737038 CET	49896	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.537074089 CET	49897	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.576297045 CET	12377	49896	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:30.705209970 CET	12377	49896	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:30.705262899 CET	12377	49896	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:30.705945969 CET	12377	49897	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:30.706008911 CET	49897	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.762953043 CET	49897	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.875227928 CET	12377	49897	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:30.875307083 CET	49897	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.876081944 CET	49897	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.877150059 CET	49898	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:30.931957960 CET	12377	49897	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.044441938 CET	12377	49897	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.044827938 CET	12377	49897	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.046091080 CET	12377	49898	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.049575090 CET	49898	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.091041088 CET	49898	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.218816996 CET	12377	49898	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.221622944 CET	49898	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.221744061 CET	49898	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.222688913 CET	49899	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.259969950 CET	12377	49898	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.390470982 CET	12377	49899	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.390549898 CET	49899	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.390698910 CET	12377	49898	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.390711069 CET	12377	49898	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.452419043 CET	49899	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.558512926 CET	12377	49899	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.558583021 CET	49899	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.558767080 CET	49899	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.559778929 CET	49900	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.620068073 CET	12377	49899	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.726574898 CET	12377	49899	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.726597071 CET	12377	49899	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.728759050 CET	12377	49900	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.728838921 CET	49900	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.880163908 CET	49900	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.898248911 CET	12377	49900	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:31.898315907 CET	49900	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.898528099 CET	49900	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:31.899420977 CET	49901	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.049005032 CET	12377	49900	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.066809893 CET	12377	49901	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.066895962 CET	49901	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.066935062 CET	12377	49900	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.067181110 CET	12377	49900	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.118551970 CET	49901	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.234595060 CET	12377	49901	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.235987902 CET	49901	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.236123085 CET	49901	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.237083912 CET	49902	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.285917997 CET	12377	49901	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.403644085 CET	12377	49901	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.403662920 CET	12377	49901	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.405767918 CET	12377	49902	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.408392906 CET	49902	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.475847960 CET	49902	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.577183008 CET	12377	49902	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.577270985 CET	49902	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.577601910 CET	49902	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.579683065 CET	49903	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.644613981 CET	12377	49902	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.745790005 CET	12377	49902	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.746212006 CET	12377	49902	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.748428106 CET	12377	49903	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.748511076 CET	49903	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.787019968 CET	49903	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.917634010 CET	12377	49903	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:32.917756081 CET	49903	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.917876005 CET	49903	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.918874979 CET	49904	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:32.955714941 CET	12377	49903	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.086488962 CET	12377	49903	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.086504936 CET	12377	49903	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.087371111 CET	12377	49904	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.087460995 CET	49904	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.135083914 CET	49904	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.256321907 CET	12377	49904	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.256412983 CET	49904	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.256710052 CET	49904	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.261226892 CET	49905	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.304202080 CET	12377	49904	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.424981117 CET	12377	49904	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.425318003 CET	12377	49904	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.431036949 CET	12377	49905	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.431627989 CET	49905	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.476243019 CET	49905	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.602106094 CET	12377	49905	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.602178097 CET	49905	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.602530003 CET	49905	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.603519917 CET	49906	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.665955067 CET	12377	49905	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.771339893 CET	12377	49906	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.771454096 CET	49906	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.772139072 CET	12377	49905	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.773104906 CET	12377	49905	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.934293032 CET	49906	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.938994884 CET	12377	49906	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:33.939047098 CET	49906	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.939187050 CET	49906	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:33.940093994 CET	49907	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.101584911 CET	12377	49906	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.106237888 CET	12377	49906	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.106251955 CET	12377	49906	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.109206915 CET	12377	49907	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.109294891 CET	49907	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.155006886 CET	49907	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.278759003 CET	12377	49907	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.279656887 CET	49907	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.290375948 CET	49907	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.296782017 CET	49908	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.324081898 CET	12377	49907	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.448683023 CET	12377	49907	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.459665060 CET	12377	49907	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.465442896 CET	12377	49908	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.465523958 CET	49908	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.523482084 CET	49908	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.634340048 CET	12377	49908	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.634524107 CET	49908	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.634867907 CET	49908	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.635958910 CET	49909	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.692003965 CET	12377	49908	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.803143024 CET	12377	49908	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.803318977 CET	12377	49908	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.805664062 CET	12377	49909	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.805738926 CET	49909	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.863596916 CET	49909	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.975775957 CET	12377	49909	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:34.975848913 CET	49909	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.977106094 CET	49909	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:34.978266001 CET	49910	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.033375978 CET	12377	49909	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.145615101 CET	12377	49909	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.146787882 CET	12377	49909	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.147839069 CET	12377	49910	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.151922941 CET	49910	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.191934109 CET	49910	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.321825027 CET	12377	49910	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.323895931 CET	49910	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.326548100 CET	49910	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.327545881 CET	49911	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.361478090 CET	12377	49910	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.493663073 CET	12377	49910	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.496121883 CET	12377	49910	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.497226954 CET	12377	49911	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.497302055 CET	49911	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.619599104 CET	49911	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.667169094 CET	12377	49911	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.668287992 CET	49911	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.668842077 CET	49911	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.669826031 CET	49912	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.789488077 CET	12377	49911	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.837383986 CET	12377	49912	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.837513924 CET	49912	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:35.837973118 CET	12377	49911	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.838231087 CET	12377	49911	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:35.883635998 CET	49912	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.005145073 CET	12377	49912	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.005223036 CET	49912	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.007282972 CET	49912	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.008424997 CET	49913	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.051167011 CET	12377	49912	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.172723055 CET	12377	49912	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.174746990 CET	12377	49912	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.178513050 CET	12377	49913	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.178585052 CET	49913	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.238337040 CET	49913	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.348982096 CET	12377	49913	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.349200010 CET	49913	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.349464893 CET	49913	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.350385904 CET	49914	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.408417940 CET	12377	49913	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.519324064 CET	12377	49913	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.519448042 CET	12377	49913	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.519759893 CET	12377	49914	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.519993067 CET	49914	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.593715906 CET	49914	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.688916922 CET	12377	49914	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.688977957 CET	49914	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.689410925 CET	49914	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.690347910 CET	49915	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.762547016 CET	12377	49914	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.857736111 CET	12377	49914	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.857754946 CET	12377	49915	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.857840061 CET	49915	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:36.858064890 CET	12377	49914	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:36.931019068 CET	49915	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.026254892 CET	12377	49915	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.026360035 CET	49915	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.026582956 CET	49915	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.028021097 CET	49916	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.098522902 CET	12377	49915	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.194041014 CET	12377	49915	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.194061995 CET	12377	49915	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.196563005 CET	12377	49916	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.196659088 CET	49916	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.245206118 CET	49916	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.364743948 CET	12377	49916	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.367844105 CET	49916	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.368815899 CET	49916	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.369868040 CET	49917	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.412619114 CET	12377	49916	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.535480022 CET	12377	49916	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.535931110 CET	12377	49916	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.539150953 CET	12377	49917	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.539228916 CET	49917	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.626450062 CET	49917	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.708854914 CET	12377	49917	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.708920002 CET	49917	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.709549904 CET	49917	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.710587978 CET	49918	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:37.795603991 CET	12377	49917	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.878070116 CET	12377	49917	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.878483057 CET	12377	49917	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.880523920 CET	12377	49918	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:37.880619049 CET	49918	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.034610987 CET	49918	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.050997019 CET	12377	49918	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.051059008 CET	49918	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.051214933 CET	49918	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.052247047 CET	49919	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.204881907 CET	12377	49918	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.219753981 CET	12377	49919	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.221158028 CET	12377	49918	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.221210957 CET	49919	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.221297979 CET	12377	49918	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.261902094 CET	49919	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.388941050 CET	12377	49919	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.391736031 CET	49919	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.391974926 CET	49919	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.392846107 CET	49920	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.429380894 CET	12377	49919	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.559587002 CET	12377	49919	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.559604883 CET	12377	49919	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.562999964 CET	12377	49920	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.563082933 CET	49920	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.647767067 CET	49920	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.733469963 CET	12377	49920	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.733664989 CET	49920	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.734354973 CET	49920	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.736005068 CET	49921	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.818418026 CET	12377	49920	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.907748938 CET	12377	49920	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.908334017 CET	12377	49921	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.908346891 CET	12377	49920	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:38.908416986 CET	49921	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:38.978275061 CET	49921	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.076297045 CET	12377	49921	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.076385021 CET	49921	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.077150106 CET	49921	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.078969955 CET	49922	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.146596909 CET	12377	49921	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.244121075 CET	12377	49921	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.244813919 CET	12377	49921	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.248615980 CET	12377	49922	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.248691082 CET	49922	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.297152996 CET	49922	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.417042017 CET	12377	49922	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.419706106 CET	49922	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.422204018 CET	49922	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.423239946 CET	49923	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.465363979 CET	12377	49922	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.588116884 CET	12377	49922	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.590152025 CET	12377	49922	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.596338987 CET	12377	49923	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.596406937 CET	49923	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.661338091 CET	49923	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.765202045 CET	12377	49923	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.765276909 CET	49923	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.765748024 CET	49923	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.766748905 CET	49924	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.829920053 CET	12377	49923	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.933902025 CET	12377	49923	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.934282064 CET	12377	49923	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.935945988 CET	12377	49924	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:39.936031103 CET	49924	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:39.985886097 CET	49924	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.105076075 CET	12377	49924	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.105148077 CET	49924	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.105372906 CET	49924	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.106863022 CET	49925	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.154654980 CET	12377	49924	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.274003983 CET	12377	49924	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.274024963 CET	12377	49924	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.274058104 CET	12377	49925	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.274182081 CET	49925	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.332237005 CET	49925	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.441998005 CET	12377	49925	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.443985939 CET	49925	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.444153070 CET	49925	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.445219040 CET	49926	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.499773979 CET	12377	49925	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.611694098 CET	12377	49925	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.611766100 CET	12377	49925	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.612716913 CET	12377	49926	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.612832069 CET	49926	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.719367981 CET	49926	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.781021118 CET	12377	49926	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.781109095 CET	49926	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.785772085 CET	49926	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.787605047 CET	49927	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:40.887231112 CET	12377	49926	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.948601961 CET	12377	49926	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.953113079 CET	12377	49926	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.954761982 CET	12377	49927	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:40.954840899 CET	49927	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.023051023 CET	49927	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.122431993 CET	12377	49927	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.122505903 CET	49927	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.122883081 CET	49927	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.124247074 CET	49928	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.190465927 CET	12377	49927	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.290604115 CET	12377	49927	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.290915966 CET	12377	49927	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.293869972 CET	12377	49928	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.294048071 CET	49928	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.353373051 CET	49928	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.463848114 CET	12377	49928	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.465629101 CET	49928	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.467005014 CET	49928	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.473530054 CET	49929	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.523225069 CET	12377	49928	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.635288954 CET	12377	49928	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.636516094 CET	12377	49928	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.641566038 CET	12377	49929	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.641719103 CET	49929	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.710293055 CET	49929	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.809736967 CET	12377	49929	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.809820890 CET	49929	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.809973001 CET	49929	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.811155081 CET	49930	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:41.877971888 CET	12377	49929	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.977724075 CET	12377	49929	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.977754116 CET	12377	49929	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.980355978 CET	12377	49930	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:41.980447054 CET	49930	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.031826973 CET	49930	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.149843931 CET	12377	49930	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.149925947 CET	49930	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.150434017 CET	49930	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.152046919 CET	49931	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.200987101 CET	12377	49930	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.319031000 CET	12377	49930	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.319389105 CET	12377	49930	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.321778059 CET	12377	49931	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.321860075 CET	49931	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.375763893 CET	49931	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.492280006 CET	12377	49931	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.493685007 CET	49931	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.506973982 CET	49931	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.508249998 CET	49932	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.545558929 CET	12377	49931	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.663513899 CET	12377	49931	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.676759958 CET	12377	49931	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.677814960 CET	12377	49932	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.677902937 CET	49932	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.788233995 CET	49932	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.847640038 CET	12377	49932	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:42.847748041 CET	49932	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.848545074 CET	49932	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.849870920 CET	49933	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:42.957856894 CET	12377	49932	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.017359972 CET	12377	49932	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.017386913 CET	12377	49933	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.017467022 CET	49933	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.017965078 CET	12377	49932	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.067445993 CET	49933	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.185167074 CET	12377	49933	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.185241938 CET	49933	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.185611963 CET	49933	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.186693907 CET	49934	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.235234022 CET	12377	49933	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.352816105 CET	12377	49933	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.352927923 CET	12377	49933	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.354100943 CET	12377	49934	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.354192972 CET	49934	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.408751011 CET	49934	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.523977041 CET	12377	49934	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.525634050 CET	49934	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.526539087 CET	49934	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.535445929 CET	49935	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.579879045 CET	12377	49934	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.693167925 CET	12377	49934	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.693845034 CET	12377	49934	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.705490112 CET	12377	49935	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.705584049 CET	49935	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.875833035 CET	12377	49935	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:43.876039028 CET	49935	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.906228065 CET	49935	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.907100916 CET	49935	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:43.908438921 CET	49936	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.075900078 CET	12377	49936	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.075978994 CET	49936	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.075994968 CET	12377	49935	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.076771021 CET	12377	49935	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.126674891 CET	49936	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.243546009 CET	12377	49936	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.245645046 CET	49936	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.245857000 CET	49936	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.246834993 CET	49937	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.294219971 CET	12377	49936	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.413885117 CET	12377	49936	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.413911104 CET	12377	49936	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.414638996 CET	12377	49937	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.417639971 CET	49937	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.460402012 CET	49937	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.585191965 CET	12377	49937	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.585273027 CET	49937	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.585513115 CET	49937	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.587078094 CET	49938	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.627655983 CET	12377	49937	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.753494978 CET	12377	49937	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.753520012 CET	12377	49937	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.754399061 CET	12377	49938	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.754517078 CET	49938	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.807856083 CET	49938	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.922276974 CET	12377	49938	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:44.922383070 CET	49938	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.922542095 CET	49938	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.924197912 CET	49939	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:44.975095987 CET	12377	49938	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.089531898 CET	12377	49938	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.089551926 CET	12377	49938	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.091561079 CET	12377	49939	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.091664076 CET	49939	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.205862999 CET	49939	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.259207010 CET	12377	49939	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.259277105 CET	49939	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.259785891 CET	49939	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.260879993 CET	49940	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.373395920 CET	12377	49939	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.426842928 CET	12377	49939	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.427238941 CET	12377	49939	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.429760933 CET	12377	49940	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.429841995 CET	49940	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.551011086 CET	49940	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.599036932 CET	12377	49940	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.599104881 CET	49940	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.599399090 CET	49940	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.600450039 CET	49941	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.720243931 CET	12377	49940	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.767978907 CET	12377	49940	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.768352985 CET	12377	49940	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.770216942 CET	12377	49941	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.770298004 CET	49941	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.829349041 CET	49941	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.940232992 CET	12377	49941	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:45.940314054 CET	49941	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.941251993 CET	49941	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.942222118 CET	49942	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:45.999047041 CET	12377	49941	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.109987974 CET	12377	49942	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.110053062 CET	12377	49941	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.110074043 CET	49942	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.110768080 CET	12377	49941	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.158433914 CET	49942	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.278188944 CET	12377	49942	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.281601906 CET	49942	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.284497976 CET	49942	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.285835981 CET	49943	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.325907946 CET	12377	49942	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.449090004 CET	12377	49942	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.451826096 CET	12377	49942	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.453071117 CET	12377	49943	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.453243017 CET	49943	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.496882915 CET	49943	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.620613098 CET	12377	49943	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.620695114 CET	49943	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.620892048 CET	49943	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.621901035 CET	49944	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.666289091 CET	12377	49943	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.790024996 CET	12377	49943	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.790049076 CET	12377	49943	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.792112112 CET	12377	49944	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.792227030 CET	49944	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.839637995 CET	49944	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.962306976 CET	12377	49944	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:46.962460995 CET	49944	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.963078976 CET	49944	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:46.965809107 CET	49945	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.009676933 CET	12377	49944	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.132281065 CET	12377	49944	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.132919073 CET	12377	49944	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.134635925 CET	12377	49945	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.134716034 CET	49945	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.192044020 CET	49945	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.304270029 CET	12377	49945	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.304380894 CET	49945	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.305672884 CET	49945	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.306972980 CET	49946	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.361099958 CET	12377	49945	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.473465919 CET	12377	49945	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.474498034 CET	12377	49945	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.476600885 CET	12377	49946	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.476686001 CET	49946	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.560353994 CET	49946	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.646545887 CET	12377	49946	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.646637917 CET	49946	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.647105932 CET	49946	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.648175955 CET	49947	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.730173111 CET	12377	49946	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.816258907 CET	12377	49946	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.816687107 CET	12377	49946	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.817100048 CET	12377	49947	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.817182064 CET	49947	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.876308918 CET	49947	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.986480951 CET	12377	49947	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:47.987807035 CET	49947	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:47.990297079 CET	49947	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.002846003 CET	49948	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.045689106 CET	12377	49947	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.156825066 CET	12377	49947	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.159188986 CET	12377	49947	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.170557976 CET	12377	49948	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.170650959 CET	49948	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.265774965 CET	49948	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.338289022 CET	12377	49948	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.341629982 CET	49948	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.345846891 CET	49948	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.346960068 CET	49949	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.433427095 CET	12377	49948	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.509046078 CET	12377	49948	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.513303995 CET	12377	49948	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.515758991 CET	12377	49949	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.517596960 CET	49949	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.586730957 CET	49949	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.686722994 CET	12377	49949	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.689285040 CET	49949	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.690226078 CET	49949	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.691293955 CET	49950	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.755600929 CET	12377	49949	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.858417034 CET	12377	49949	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.858958960 CET	12377	49949	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.860955954 CET	12377	49950	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:48.861104012 CET	49950	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:48.998960018 CET	49950	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.031661987 CET	12377	49950	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.033663988 CET	49950	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.036062956 CET	49950	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.036974907 CET	49951	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.168638945 CET	12377	49950	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.203196049 CET	12377	49950	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.205627918 CET	12377	49950	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.206939936 CET	12377	49951	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.207158089 CET	49951	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.252526999 CET	49951	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.377492905 CET	12377	49951	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.378808975 CET	49951	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.379060984 CET	49951	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.380182981 CET	49952	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.423355103 CET	12377	49951	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.548955917 CET	12377	49951	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.549021959 CET	12377	49951	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.550342083 CET	12377	49952	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.551798105 CET	49952	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.603125095 CET	49952	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.722364902 CET	12377	49952	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.722496033 CET	49952	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.723328114 CET	49952	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.724437952 CET	49953	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.773350954 CET	12377	49952	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.893507004 CET	12377	49952	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.893677950 CET	12377	49952	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.894546986 CET	12377	49953	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:49.894625902 CET	49953	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:49.946430922 CET	49953	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.065387011 CET	12377	49953	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.065469980 CET	49953	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.068229914 CET	49953	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.077603102 CET	49954	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.116765022 CET	12377	49953	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.235497952 CET	12377	49953	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.239036083 CET	12377	49953	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.245374918 CET	12377	49954	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.245610952 CET	49954	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.307672024 CET	49954	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.414295912 CET	12377	49954	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.414378881 CET	49954	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.463655949 CET	49954	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.464643955 CET	49955	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.476350069 CET	12377	49954	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.581962109 CET	12377	49954	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.631391048 CET	12377	49954	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.634674072 CET	12377	49955	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.634759903 CET	49955	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.745636940 CET	49955	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.805135012 CET	12377	49955	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.805200100 CET	49955	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.806113005 CET	49955	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.808324099 CET	49956	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:50.916011095 CET	12377	49955	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.975328922 CET	12377	49955	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.976167917 CET	12377	49955	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.976938963 CET	12377	49956	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:50.977015018 CET	49956	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.037560940 CET	49956	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.145698071 CET	12377	49956	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.147609949 CET	49956	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.147757053 CET	49956	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.148725033 CET	49957	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.206507921 CET	12377	49956	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.316473961 CET	12377	49956	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.316498041 CET	12377	49956	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.317446947 CET	12377	49957	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.319722891 CET	49957	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.375401974 CET	49957	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.488682985 CET	12377	49957	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.489589930 CET	49957	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.490314960 CET	49957	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.491290092 CET	49958	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.544323921 CET	12377	49957	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.658329010 CET	12377	49957	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.658740044 CET	12377	49957	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.660068035 CET	12377	49958	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.660152912 CET	49958	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.723576069 CET	49958	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.829204082 CET	12377	49958	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.829293966 CET	49958	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.829622984 CET	49958	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.830622911 CET	49959	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:51.892745018 CET	12377	49958	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.998347998 CET	12377	49958	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:51.998482943 CET	12377	49958	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.000567913 CET	12377	49959	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.000715017 CET	49959	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.061647892 CET	49959	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.170861006 CET	12377	49959	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.170934916 CET	49959	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.171149969 CET	49959	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.172314882 CET	49960	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.231695890 CET	12377	49959	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.340823889 CET	12377	49959	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.340931892 CET	12377	49959	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.341994047 CET	12377	49960	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.345582008 CET	49960	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.392437935 CET	49960	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.515729904 CET	12377	49960	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.515896082 CET	49960	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.516290903 CET	49960	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.517297029 CET	49961	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.562880039 CET	12377	49960	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.685745001 CET	12377	49960	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.685945034 CET	12377	49960	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.686928988 CET	12377	49961	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.689634085 CET	49961	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.823288918 CET	49961	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.859474897 CET	12377	49961	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:52.859560013 CET	49961	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.860831022 CET	49961	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.861907005 CET	49962	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:52.992898941 CET	12377	49961	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.030333042 CET	12377	49961	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.030723095 CET	12377	49961	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.031857014 CET	12377	49962	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.031955957 CET	49962	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.085925102 CET	49962	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.202601910 CET	12377	49962	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.202675104 CET	49962	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.202889919 CET	49962	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.204524040 CET	49963	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.255670071 CET	12377	49962	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.373586893 CET	12377	49962	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.373611927 CET	12377	49962	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.374350071 CET	12377	49963	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.374458075 CET	49963	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.457472086 CET	49963	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.545072079 CET	12377	49963	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.545583963 CET	49963	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.546189070 CET	49963	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.547142982 CET	49964	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.627430916 CET	12377	49963	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.716185093 CET	12377	49963	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.716203928 CET	12377	49963	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.717308998 CET	12377	49964	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.717382908 CET	49964	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.783365011 CET	49964	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.888499022 CET	12377	49964	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:53.888575077 CET	49964	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.888982058 CET	49964	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.890033960 CET	49965	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:53.953346968 CET	12377	49964	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.058696985 CET	12377	49964	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.059309959 CET	12377	49965	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.059390068 CET	49965	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.059547901 CET	12377	49964	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.108361959 CET	49965	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.228868961 CET	12377	49965	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.229027987 CET	49965	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.229667902 CET	49965	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.230678082 CET	49966	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.277990103 CET	12377	49965	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.398216009 CET	12377	49965	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.398650885 CET	12377	49965	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.399720907 CET	12377	49966	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.399815083 CET	49966	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.457511902 CET	49966	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.570000887 CET	12377	49966	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.571609974 CET	49966	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.571789980 CET	49966	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.572920084 CET	49967	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.627924919 CET	12377	49966	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.742572069 CET	12377	49967	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.742599964 CET	12377	49966	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.742613077 CET	12377	49966	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.742660999 CET	49967	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.802309990 CET	49967	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.910258055 CET	12377	49967	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:54.910320044 CET	49967	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.910486937 CET	49967	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.911457062 CET	49968	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:54.969794035 CET	12377	49967	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.077729940 CET	12377	49967	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.077758074 CET	12377	49967	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.080981016 CET	12377	49968	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.081068993 CET	49968	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.132736921 CET	49968	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.251600981 CET	12377	49968	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.251720905 CET	49968	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.252665043 CET	49968	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.253874063 CET	49969	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.302932024 CET	12377	49968	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.421436071 CET	12377	49968	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.421464920 CET	12377	49969	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.421550989 CET	49969	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.422771931 CET	12377	49968	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.464162111 CET	49969	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.589409113 CET	12377	49969	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.589757919 CET	49969	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.590766907 CET	49969	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.590773106 CET	49970	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.632249117 CET	12377	49969	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.757340908 CET	12377	49969	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.758102894 CET	12377	49969	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.759649992 CET	12377	49970	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.759879112 CET	49970	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.824935913 CET	49970	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.930638075 CET	12377	49970	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:55.930720091 CET	49970	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.931013107 CET	49970	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.932090044 CET	49971	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:55.993837118 CET	12377	49970	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.099546909 CET	12377	49970	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.099756956 CET	12377	49970	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.101701975 CET	12377	49971	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.101819992 CET	49971	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.145690918 CET	49971	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.271817923 CET	12377	49971	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.271897078 CET	49971	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.272111893 CET	49971	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.273494005 CET	49972	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.315462112 CET	12377	49971	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.441639900 CET	12377	49971	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.441663980 CET	12377	49971	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.443186045 CET	12377	49972	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.445606947 CET	49972	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.485508919 CET	49972	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.615578890 CET	12377	49972	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.616164923 CET	49972	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.616432905 CET	49972	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.617381096 CET	49973	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.655302048 CET	12377	49972	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.786046982 CET	12377	49972	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.786137104 CET	12377	49972	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.787199974 CET	12377	49973	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.787651062 CET	49973	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.878213882 CET	49973	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.957581997 CET	12377	49973	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:56.959750891 CET	49973	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.961188078 CET	49973	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:56.962208033 CET	49974	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.047925949 CET	12377	49973	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.129421949 CET	12377	49973	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.130676031 CET	12377	49973	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.131892920 CET	12377	49974	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.131998062 CET	49974	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.188988924 CET	49974	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.301932096 CET	12377	49974	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.302023888 CET	49974	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.302189112 CET	49974	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.303219080 CET	49975	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.358730078 CET	12377	49974	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.471826077 CET	12377	49974	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.471899986 CET	12377	49974	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.473666906 CET	12377	49975	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.473737955 CET	49975	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.549082041 CET	49975	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.644264936 CET	12377	49975	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.644376993 CET	49975	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.645503044 CET	49975	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.647279024 CET	49976	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.719460964 CET	12377	49975	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.815054893 CET	12377	49975	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.815717936 CET	12377	49975	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.817836046 CET	12377	49976	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.817960024 CET	49976	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.865801096 CET	49976	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.987730026 CET	12377	49976	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:57.987832069 CET	49976	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.988326073 CET	49976	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:57.989239931 CET	49977	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.035397053 CET	12377	49976	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.156862020 CET	12377	49977	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.156956911 CET	49977	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.157594919 CET	12377	49976	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.157799006 CET	12377	49976	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.254076958 CET	49977	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.326925993 CET	12377	49977	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.327003002 CET	49977	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.327251911 CET	49977	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.328851938 CET	49978	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.421829939 CET	12377	49977	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.494710922 CET	12377	49977	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.495364904 CET	12377	49977	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.498048067 CET	12377	49978	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.498127937 CET	49978	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.553690910 CET	49978	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.668287039 CET	12377	49978	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.669646025 CET	49978	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.670700073 CET	49978	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.671600103 CET	49979	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.722723961 CET	12377	49978	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.838445902 CET	12377	49978	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.839320898 CET	12377	49978	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.840631008 CET	12377	49979	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:58.840704918 CET	49979	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:58.903008938 CET	49979	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.010082006 CET	12377	49979	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.010147095 CET	49979	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.010516882 CET	49979	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.011555910 CET	49980	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.072195053 CET	12377	49979	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.179356098 CET	12377	49979	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.179476023 CET	12377	49979	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.180432081 CET	12377	49980	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.180516005 CET	49980	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.242532015 CET	49980	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.349642038 CET	12377	49980	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.349714994 CET	49980	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.349874973 CET	49980	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.350841999 CET	49981	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.411411047 CET	12377	49980	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.518595934 CET	12377	49981	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.518723011 CET	12377	49980	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.518840075 CET	12377	49980	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.518851995 CET	49981	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.554934025 CET	49981	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.686655998 CET	12377	49981	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.686749935 CET	49981	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.688499928 CET	49981	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.689596891 CET	49982	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.722889900 CET	12377	49981	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.854408979 CET	12377	49981	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.856061935 CET	12377	49981	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.858561993 CET	12377	49982	18.197.239.109	192.168.2.7
Mar 20, 2024 11:34:59.858634949 CET	49982	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:34:59.936048031 CET	49982	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:00.027698994 CET	12377	49982	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:00.027854919 CET	49982	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:00.035039902 CET	49982	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:00.036119938 CET	49983	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:00.104887962 CET	12377	49982	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:00.196822882 CET	12377	49982	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:00.203960896 CET	12377	49982	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:00.204993010 CET	12377	49983	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:00.205100060 CET	49983	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:00.374171019 CET	12377	49983	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:00.375679970 CET	49983	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.149081945 CET	49983	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.149475098 CET	49983	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.150391102 CET	49984	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.318053007 CET	12377	49984	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.318079948 CET	12377	49983	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.318252087 CET	49984	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.318295002 CET	12377	49983	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.364485025 CET	49984	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.486819983 CET	12377	49984	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.486936092 CET	49984	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.487138987 CET	49984	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.488302946 CET	49985	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.532075882 CET	12377	49984	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.655780077 CET	12377	49985	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.655899048 CET	49985	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.655921936 CET	12377	49984	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.656022072 CET	12377	49984	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.699409008 CET	49985	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.823309898 CET	12377	49985	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.823375940 CET	49985	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.823678970 CET	49985	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.825124979 CET	49986	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:02.867721081 CET	12377	49985	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.990720034 CET	12377	49985	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.990827084 CET	12377	49985	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.992604971 CET	12377	49986	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:02.992677927 CET	49986	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.102543116 CET	49986	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.160330057 CET	12377	49986	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.160442114 CET	49986	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.160595894 CET	49986	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.161544085 CET	49987	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.270895004 CET	12377	49986	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.327914000 CET	12377	49986	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.328006029 CET	12377	49986	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.328785896 CET	12377	49987	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.328897953 CET	49987	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.429780006 CET	49987	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.496448040 CET	12377	49987	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.496520042 CET	49987	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.496853113 CET	49987	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.499145031 CET	49988	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.597876072 CET	12377	49987	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.663734913 CET	12377	49987	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.664067984 CET	12377	49987	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.669570923 CET	12377	49988	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.669660091 CET	49988	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.714910984 CET	49988	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.838597059 CET	12377	49988	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:03.838681936 CET	49988	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.838928938 CET	49988	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.840239048 CET	49989	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:03.883336067 CET	12377	49988	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.007298946 CET	12377	49988	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.007466078 CET	12377	49988	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.007659912 CET	12377	49989	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.007750988 CET	49989	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.112008095 CET	49989	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.175487995 CET	12377	49989	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.175569057 CET	49989	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.175756931 CET	49989	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.176739931 CET	49990	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.279571056 CET	12377	49989	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.343194962 CET	12377	49989	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.343211889 CET	12377	49989	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.344264030 CET	12377	49990	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.344357967 CET	49990	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.387917042 CET	49990	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.512175083 CET	12377	49990	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.512248039 CET	49990	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.512697935 CET	49990	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.513921976 CET	49991	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.555411100 CET	12377	49990	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.679894924 CET	12377	49990	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.680273056 CET	12377	49990	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.682831049 CET	12377	49991	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.682917118 CET	49991	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.724438906 CET	49991	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.851835012 CET	12377	49991	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:04.851907015 CET	49991	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.852157116 CET	49991	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.853876114 CET	49992	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:04.893187046 CET	12377	49991	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.020605087 CET	12377	49991	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.020698071 CET	12377	49991	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.023690939 CET	12377	49992	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.023761034 CET	49992	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.118997097 CET	49992	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.193759918 CET	12377	49992	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.193823099 CET	49992	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.194070101 CET	49992	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.195749044 CET	49993	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.288973093 CET	12377	49992	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.364082098 CET	12377	49992	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.364243031 CET	12377	49992	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.364471912 CET	12377	49993	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.364538908 CET	49993	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.421447039 CET	49993	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.533428907 CET	12377	49993	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.533492088 CET	49993	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.533763885 CET	49993	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.535458088 CET	49994	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.590106010 CET	12377	49993	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.702163935 CET	12377	49993	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.702312946 CET	12377	49993	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.705065966 CET	12377	49994	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.705137014 CET	49994	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.773004055 CET	49994	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.875017881 CET	12377	49994	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:05.881587029 CET	49994	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.885565996 CET	49994	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.885574102 CET	49995	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:05.942917109 CET	12377	49994	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.051275969 CET	12377	49994	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.054227114 CET	12377	49995	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.055257082 CET	12377	49994	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.055465937 CET	49995	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.164535046 CET	49995	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.225600958 CET	12377	49995	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.229624033 CET	49995	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.230204105 CET	49995	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.231395960 CET	49996	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.333234072 CET	12377	49995	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.398197889 CET	12377	49995	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.398655891 CET	12377	49995	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.399032116 CET	12377	49996	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.400202990 CET	49996	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.450351954 CET	49996	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.568418980 CET	12377	49996	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.571852922 CET	49996	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.574219942 CET	49996	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.574224949 CET	49997	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.618186951 CET	12377	49996	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.739823103 CET	12377	49996	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.741903067 CET	12377	49996	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.744234085 CET	12377	49997	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.747683048 CET	49997	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.799684048 CET	49997	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.917779922 CET	12377	49997	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:06.917843103 CET	49997	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.918205976 CET	49997	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.919812918 CET	49998	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:06.969929934 CET	12377	49997	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.087649107 CET	12377	49997	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.087784052 CET	12377	49997	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.089541912 CET	12377	49998	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.089616060 CET	49998	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.155627966 CET	49998	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.259758949 CET	12377	49998	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.259829044 CET	49998	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.260071039 CET	49998	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.261168957 CET	49999	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.325438023 CET	12377	49998	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.429924965 CET	12377	49998	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.430075884 CET	12377	49998	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.430090904 CET	12377	49999	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.430152893 CET	49999	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.495588064 CET	49999	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.600286961 CET	12377	49999	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.600342989 CET	49999	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.601197958 CET	49999	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.602603912 CET	50000	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.664731026 CET	12377	49999	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.770836115 CET	12377	49999	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.770999908 CET	12377	49999	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.772631884 CET	12377	50000	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.772736073 CET	50000	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.851633072 CET	50000	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.943001986 CET	12377	50000	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:07.943094015 CET	50000	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.946033001 CET	50000	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:07.947062016 CET	50001	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.023077965 CET	12377	50000	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.113444090 CET	12377	50000	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.117660999 CET	12377	50000	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.118124008 CET	12377	50001	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.118216038 CET	50001	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.182517052 CET	50001	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.288655043 CET	12377	50001	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.288729906 CET	50001	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.289196014 CET	50001	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.290184021 CET	50002	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.352427006 CET	12377	50001	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.457834005 CET	12377	50002	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.457914114 CET	50002	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.458548069 CET	12377	50001	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.458926916 CET	12377	50001	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.534243107 CET	50002	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.626342058 CET	12377	50002	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.626421928 CET	50002	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.627120018 CET	50002	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.628202915 CET	50003	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.701894999 CET	12377	50002	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.793937922 CET	12377	50002	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.794508934 CET	12377	50002	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.797910929 CET	12377	50003	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.797981024 CET	50003	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.872270107 CET	50003	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.967922926 CET	12377	50003	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:08.967982054 CET	50003	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.968358994 CET	50003	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:08.969502926 CET	50004	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.042010069 CET	12377	50003	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.137023926 CET	12377	50004	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.137106895 CET	50004	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.137630939 CET	12377	50003	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.137964964 CET	12377	50003	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.246598005 CET	50004	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.304826975 CET	12377	50004	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.304889917 CET	50004	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.316442966 CET	50004	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.317579985 CET	50005	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.414088011 CET	12377	50004	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.472604036 CET	12377	50004	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.483854055 CET	12377	50004	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.486538887 CET	12377	50005	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.486620903 CET	50005	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.563054085 CET	50005	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.655719042 CET	12377	50005	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.655795097 CET	50005	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.655958891 CET	50005	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.656889915 CET	50006	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.732048988 CET	12377	50005	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.824537039 CET	12377	50006	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.824654102 CET	50006	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.824769974 CET	12377	50005	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.824789047 CET	12377	50005	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.869043112 CET	50006	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.992487907 CET	12377	50006	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:09.992619991 CET	50006	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.993648052 CET	50006	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:09.994908094 CET	50007	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.036602974 CET	12377	50006	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.160391092 CET	12377	50006	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.161257029 CET	12377	50006	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.164397001 CET	12377	50007	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.171647072 CET	50007	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.341737986 CET	12377	50007	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.341824055 CET	50007	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.370326996 CET	50007	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.371417999 CET	50007	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.371422052 CET	50008	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.539921999 CET	12377	50007	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.539999962 CET	12377	50008	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.540726900 CET	12377	50007	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.541049004 CET	50008	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.620546103 CET	50008	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.709855080 CET	12377	50008	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.710964918 CET	50008	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.719672918 CET	50008	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.724766016 CET	50009	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.789269924 CET	12377	50008	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.879709005 CET	12377	50008	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.888142109 CET	12377	50008	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.893615961 CET	12377	50009	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:10.893745899 CET	50009	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:10.936183929 CET	50009	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.062534094 CET	12377	50009	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.062613964 CET	50009	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.062860012 CET	50009	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.063966990 CET	50010	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.104821920 CET	12377	50009	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.232047081 CET	12377	50009	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.232073069 CET	12377	50009	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.233406067 CET	12377	50010	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.233486891 CET	50010	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.318619013 CET	50010	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.403608084 CET	12377	50010	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.403671980 CET	50010	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.404194117 CET	50010	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.405597925 CET	50011	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.488107920 CET	12377	50010	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.572838068 CET	12377	50011	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.572902918 CET	50011	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.573003054 CET	12377	50010	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.573509932 CET	12377	50010	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.653302908 CET	50011	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.740669012 CET	12377	50011	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.740732908 CET	50011	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.741213083 CET	50011	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.742247105 CET	50012	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.820673943 CET	12377	50011	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.908081055 CET	12377	50011	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.908484936 CET	12377	50011	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.910723925 CET	12377	50012	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:11.910855055 CET	50012	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:11.957578897 CET	50012	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.078490973 CET	12377	50012	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.078571081 CET	50012	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.078766108 CET	50012	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.081572056 CET	50013	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.125161886 CET	12377	50012	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.246162891 CET	12377	50012	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.246207952 CET	12377	50012	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.250102997 CET	12377	50013	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.250264883 CET	50013	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.328814030 CET	50013	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.419243097 CET	12377	50013	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.419802904 CET	50013	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.420880079 CET	50013	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.425571918 CET	50014	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.497684002 CET	12377	50013	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.588448048 CET	12377	50013	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.589356899 CET	12377	50013	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.595494986 CET	12377	50014	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.596060038 CET	50014	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.641566992 CET	50014	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.766204119 CET	12377	50014	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.766268015 CET	50014	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.766396046 CET	50014	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.767805099 CET	50015	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:12.811487913 CET	12377	50014	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.936541080 CET	12377	50014	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.936563015 CET	12377	50014	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.936965942 CET	12377	50015	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:12.937069893 CET	50015	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.106317997 CET	12377	50015	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.106384993 CET	50015	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.122998953 CET	50015	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.124178886 CET	50015	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.127247095 CET	50016	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.292129040 CET	12377	50015	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.293224096 CET	12377	50015	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.294715881 CET	12377	50016	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.294785976 CET	50016	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.408993006 CET	50016	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.462265968 CET	12377	50016	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.462327003 CET	50016	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.462898016 CET	50016	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.464080095 CET	50017	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.576528072 CET	12377	50016	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.629853964 CET	12377	50016	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.630250931 CET	12377	50016	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.633835077 CET	12377	50017	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.633912086 CET	50017	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.718955994 CET	50017	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.804079056 CET	12377	50017	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.804409027 CET	50017	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.804589987 CET	50017	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.805571079 CET	50018	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:13.888823986 CET	12377	50017	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.974237919 CET	12377	50018	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.974277020 CET	12377	50017	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.974334002 CET	12377	50017	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:13.975569963 CET	50018	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.022066116 CET	50018	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.144423008 CET	12377	50018	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.144550085 CET	50018	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.146099091 CET	50018	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.148286104 CET	50019	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.192811966 CET	12377	50018	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.313189983 CET	12377	50018	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.315483093 CET	12377	50018	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.318583965 CET	12377	50019	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.318715096 CET	50019	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.371675968 CET	50019	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.489690065 CET	12377	50019	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.489895105 CET	50019	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.490510941 CET	50019	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.495100021 CET	50020	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.541775942 CET	12377	50019	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.661947012 CET	12377	50019	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.662123919 CET	12377	50019	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.663592100 CET	12377	50020	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.663700104 CET	50020	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.713390112 CET	50020	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.840100050 CET	12377	50020	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:14.840198040 CET	50020	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.840435982 CET	50020	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.841515064 CET	50021	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:14.881866932 CET	12377	50020	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.008641005 CET	12377	50020	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.008807898 CET	12377	50020	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.011357069 CET	12377	50021	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.011440039 CET	50021	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.066883087 CET	50021	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.181436062 CET	12377	50021	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.181514025 CET	50021	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.181756973 CET	50021	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.182805061 CET	50022	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.236722946 CET	12377	50021	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.351778030 CET	12377	50022	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.351939917 CET	50022	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.351963043 CET	12377	50021	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.352063894 CET	12377	50021	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.429586887 CET	50022	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.520977020 CET	12377	50022	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.521056890 CET	50022	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.521429062 CET	50022	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.522485971 CET	50023	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.600157022 CET	12377	50022	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.689982891 CET	12377	50023	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.690059900 CET	50023	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.690433025 CET	12377	50022	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.690608025 CET	12377	50022	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.740413904 CET	50023	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.857702017 CET	12377	50023	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:15.857773066 CET	50023	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.857968092 CET	50023	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.859330893 CET	50024	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:15.907718897 CET	12377	50023	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.025197029 CET	12377	50023	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.025226116 CET	12377	50023	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.026909113 CET	12377	50024	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.027038097 CET	50024	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.083967924 CET	50024	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.194983006 CET	12377	50024	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.195072889 CET	50024	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.195267916 CET	50024	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.197103024 CET	50025	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.251610041 CET	12377	50024	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.362960100 CET	12377	50024	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.363065004 CET	12377	50024	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.364450932 CET	12377	50025	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.364548922 CET	50025	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.488629103 CET	50025	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.531975031 CET	12377	50025	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.532064915 CET	50025	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.532536030 CET	50025	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.533427000 CET	50026	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.656018972 CET	12377	50025	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.699477911 CET	12377	50025	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.701143026 CET	12377	50025	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.703926086 CET	12377	50026	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.704005003 CET	50026	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.817845106 CET	50026	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.874401093 CET	12377	50026	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:16.874491930 CET	50026	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.874882936 CET	50026	12377	192.168.2.7	18.197.239.109
Mar 20, 2024 11:35:16.985764980 CET	50027	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:16.988126040 CET	12377	50026	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:17.044935942 CET	12377	50026	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:17.045236111 CET	12377	50026	18.197.239.109	192.168.2.7
Mar 20, 2024 11:35:17.153392076 CET	12377	50027	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.153472900 CET	50027	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.308188915 CET	50027	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.320976019 CET	12377	50027	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.321053028 CET	50027	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.321403027 CET	50027	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.322660923 CET	50028	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.475605011 CET	12377	50027	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.488482952 CET	12377	50027	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.488795042 CET	12377	50027	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.490345955 CET	12377	50028	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.490428925 CET	50028	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.624773979 CET	50028	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.658713102 CET	12377	50028	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.658839941 CET	50028	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.659182072 CET	50028	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.662452936 CET	50029	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.792376041 CET	12377	50028	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.826375961 CET	12377	50028	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.826632023 CET	12377	50028	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.832300901 CET	12377	50029	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:17.832381010 CET	50029	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:17.942826033 CET	50029	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.002474070 CET	12377	50029	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.002536058 CET	50029	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.003895998 CET	50029	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.004923105 CET	50030	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.113399982 CET	12377	50029	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.172534943 CET	12377	50029	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.173504114 CET	12377	50030	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.173584938 CET	50030	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.173722029 CET	12377	50029	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.242898941 CET	50030	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.342372894 CET	12377	50030	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.342454910 CET	50030	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.342675924 CET	50030	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.344018936 CET	50031	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.411478996 CET	12377	50030	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.511168957 CET	12377	50030	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.511883020 CET	12377	50030	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.513225079 CET	12377	50031	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.513313055 CET	50031	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.555048943 CET	50031	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.683629036 CET	12377	50031	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.683698893 CET	50031	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.684098959 CET	50031	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.684995890 CET	50032	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.724292040 CET	12377	50031	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.852832079 CET	12377	50032	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.852854967 CET	12377	50031	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.852907896 CET	50032	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:18.853004932 CET	12377	50031	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:18.911540031 CET	50032	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.020917892 CET	12377	50032	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.021068096 CET	50032	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.021440029 CET	50032	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.022504091 CET	50033	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.081515074 CET	12377	50032	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.189326048 CET	12377	50032	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.189347029 CET	12377	50032	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.189865112 CET	12377	50033	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.190109968 CET	50033	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.360403061 CET	12377	50033	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.360557079 CET	50033	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.410306931 CET	50033	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.410806894 CET	50033	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.411577940 CET	50034	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.577713966 CET	12377	50033	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.577956915 CET	12377	50033	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.581171036 CET	12377	50034	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.581265926 CET	50034	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.679646969 CET	50034	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.751172066 CET	12377	50034	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.751234055 CET	50034	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.753298044 CET	50034	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.755168915 CET	50035	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:19.849411964 CET	12377	50034	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.928250074 CET	12377	50034	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.932493925 CET	12377	50034	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.933016062 CET	12377	50035	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:19.933100939 CET	50035	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.027266979 CET	50035	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.102780104 CET	12377	50035	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.102979898 CET	50035	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.103132010 CET	50035	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.104187965 CET	50036	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.198241949 CET	12377	50035	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.272558928 CET	12377	50035	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.272588015 CET	12377	50035	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.274004936 CET	12377	50036	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.274084091 CET	50036	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.401477098 CET	50036	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.443182945 CET	12377	50036	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.443371058 CET	50036	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.443707943 CET	50036	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.444643021 CET	50037	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.570420980 CET	12377	50036	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.612417936 CET	12377	50036	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.612441063 CET	12377	50036	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.614247084 CET	12377	50037	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.614332914 CET	50037	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.700901985 CET	50037	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.784385920 CET	12377	50037	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.784455061 CET	50037	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.785197020 CET	50037	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.786117077 CET	50038	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:20.870723009 CET	12377	50037	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.954188108 CET	12377	50037	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.955235958 CET	12377	50037	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.956022024 CET	12377	50038	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:20.956085920 CET	50038	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.039913893 CET	50038	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.126110077 CET	12377	50038	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.126282930 CET	50038	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.126451969 CET	50038	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.127439022 CET	50039	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.210061073 CET	12377	50038	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.294946909 CET	12377	50039	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.295021057 CET	50039	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.296267033 CET	12377	50038	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.296282053 CET	12377	50038	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.462754965 CET	12377	50039	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.465682030 CET	50039	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.483122110 CET	50039	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.483338118 CET	50039	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.484119892 CET	50040	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.650854111 CET	12377	50039	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.650881052 CET	12377	50039	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.651794910 CET	12377	50040	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.653640985 CET	50040	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.754924059 CET	50040	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.821908951 CET	12377	50040	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.821984053 CET	50040	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.822160959 CET	50040	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.823350906 CET	50041	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:21.922684908 CET	12377	50040	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.989811897 CET	12377	50040	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.989841938 CET	12377	50040	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.991554976 CET	12377	50041	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:21.991663933 CET	50041	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.068097115 CET	50041	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.159754992 CET	12377	50041	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.159890890 CET	50041	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.160126925 CET	50041	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.161994934 CET	50042	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.236002922 CET	12377	50041	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.327635050 CET	12377	50041	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.327739000 CET	12377	50041	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.329282045 CET	12377	50042	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.329570055 CET	50042	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.425211906 CET	50042	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.497061014 CET	12377	50042	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.497122049 CET	50042	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.497345924 CET	50042	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.498430014 CET	50043	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.592694998 CET	12377	50042	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.664489031 CET	12377	50042	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.664818048 CET	12377	50042	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.668198109 CET	12377	50043	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.668302059 CET	50043	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.757702112 CET	50043	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.841619968 CET	12377	50043	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:22.841694117 CET	50043	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.842062950 CET	50043	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.843267918 CET	50044	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:22.931664944 CET	12377	50043	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.015561104 CET	12377	50044	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.015635967 CET	50044	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.016040087 CET	12377	50043	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.016376019 CET	12377	50043	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.187880993 CET	12377	50044	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.187963009 CET	50044	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.210607052 CET	50044	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.212192059 CET	50044	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.213702917 CET	50045	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.378412008 CET	12377	50044	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.379983902 CET	12377	50044	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.381469011 CET	12377	50045	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.381556034 CET	50045	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.549459934 CET	12377	50045	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.551667929 CET	50045	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.570446014 CET	50045	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.570736885 CET	50045	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.571470022 CET	50046	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.738156080 CET	12377	50045	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.738320112 CET	12377	50045	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.740061998 CET	12377	50046	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.740147114 CET	50046	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.830194950 CET	50046	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.909141064 CET	12377	50046	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:23.909214020 CET	50046	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.909605026 CET	50046	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.911325932 CET	50047	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:23.998851061 CET	12377	50046	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.078300953 CET	12377	50046	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.078649998 CET	12377	50046	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.078716993 CET	12377	50047	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.081638098 CET	50047	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.138267994 CET	50047	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.249349117 CET	12377	50047	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.249490976 CET	50047	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.249711990 CET	50047	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.251761913 CET	50048	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.305764914 CET	12377	50047	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.418005943 CET	12377	50047	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.418030024 CET	12377	50047	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.420406103 CET	12377	50048	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.420536041 CET	50048	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.505929947 CET	50048	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.590042114 CET	12377	50048	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.590275049 CET	50048	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.590440035 CET	50048	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.591315985 CET	50049	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.674582005 CET	12377	50048	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.758970976 CET	12377	50048	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.758994102 CET	12377	50048	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.760477066 CET	12377	50049	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.760548115 CET	50049	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.816973925 CET	50049	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.931292057 CET	12377	50049	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:24.932394981 CET	50049	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.932557106 CET	50049	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.933445930 CET	50050	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:24.986248970 CET	12377	50049	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.101614952 CET	12377	50049	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.101629972 CET	12377	50049	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.102884054 CET	12377	50050	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.102956057 CET	50050	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.260873079 CET	50050	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.272905111 CET	12377	50050	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.273627996 CET	50050	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.274950981 CET	50050	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.277544975 CET	50051	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.430747986 CET	12377	50050	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.444161892 CET	12377	50050	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.444483995 CET	12377	50050	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.445283890 CET	12377	50051	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.445640087 CET	50051	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.531230927 CET	50051	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.614993095 CET	12377	50051	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.615068913 CET	50051	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.615411043 CET	50051	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.616889954 CET	50052	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.699929953 CET	12377	50051	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.784641027 CET	12377	50051	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.784698963 CET	12377	50051	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.784801006 CET	12377	50052	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.784869909 CET	50052	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.876753092 CET	50052	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.952960968 CET	12377	50052	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:25.953056097 CET	50052	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.953528881 CET	50052	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:25.954493046 CET	50053	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.044358015 CET	12377	50052	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.121499062 CET	12377	50052	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.121512890 CET	12377	50052	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.123626947 CET	12377	50053	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.123697996 CET	50053	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.226942062 CET	50053	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.292978048 CET	12377	50053	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.293075085 CET	50053	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.293418884 CET	50053	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.294390917 CET	50054	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.396075010 CET	12377	50053	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.462335110 CET	12377	50053	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.462413073 CET	12377	50053	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.464030027 CET	12377	50054	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.464102983 CET	50054	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.549705029 CET	50054	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.633953094 CET	12377	50054	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.634016037 CET	50054	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.634293079 CET	50054	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.635416031 CET	50055	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.719362974 CET	12377	50054	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.803666115 CET	12377	50054	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.803766966 CET	12377	50054	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.804924965 CET	12377	50055	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.805011034 CET	50055	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.897862911 CET	50055	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.974682093 CET	12377	50055	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:26.974745035 CET	50055	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.974869967 CET	50055	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:26.975961924 CET	50056	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.067547083 CET	12377	50055	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.143946886 CET	12377	50056	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.144028902 CET	50056	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.144238949 CET	12377	50055	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.144273996 CET	12377	50055	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.221020937 CET	50056	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.312256098 CET	12377	50056	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.312313080 CET	50056	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.312638044 CET	50056	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.313579082 CET	50057	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.388823032 CET	12377	50056	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.480458975 CET	12377	50056	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.480477095 CET	12377	50056	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.481122017 CET	12377	50057	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.481244087 CET	50057	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.566068888 CET	50057	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.649002075 CET	12377	50057	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.649231911 CET	50057	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.649286032 CET	50057	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.650376081 CET	50058	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.733659029 CET	12377	50057	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.816989899 CET	12377	50057	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.817003965 CET	12377	50057	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.819188118 CET	12377	50058	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.819302082 CET	50058	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.899372101 CET	50058	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.990690947 CET	12377	50058	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:27.990813017 CET	50058	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.990978003 CET	50058	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:27.992134094 CET	50059	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.068510056 CET	12377	50058	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.159658909 CET	12377	50058	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.159832001 CET	12377	50058	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.159928083 CET	12377	50059	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.159996986 CET	50059	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.245312929 CET	50059	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.327841997 CET	12377	50059	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.327939034 CET	50059	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.328403950 CET	50059	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.329504967 CET	50060	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.412918091 CET	12377	50059	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.495338917 CET	12377	50059	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.495723963 CET	12377	50059	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.498440027 CET	12377	50060	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.498537064 CET	50060	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.630865097 CET	50060	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.667546034 CET	12377	50060	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.667802095 CET	50060	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.670185089 CET	50060	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.670986891 CET	50061	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.800132036 CET	12377	50060	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.836956024 CET	12377	50060	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.838556051 CET	12377	50061	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.838625908 CET	50061	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:28.838999987 CET	12377	50060	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:28.973268032 CET	50061	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.007286072 CET	12377	50061	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.007364035 CET	50061	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.007745981 CET	50061	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.009020090 CET	50062	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.141062021 CET	12377	50061	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.174896955 CET	12377	50061	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.175213099 CET	12377	50061	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.176621914 CET	12377	50062	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.176690102 CET	50062	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.276158094 CET	50062	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.344579935 CET	12377	50062	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.344640017 CET	50062	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.346165895 CET	50062	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.347835064 CET	50063	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.443829060 CET	12377	50062	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.512473106 CET	12377	50062	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.513709068 CET	12377	50062	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.515229940 CET	12377	50063	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.515307903 CET	50063	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.568248034 CET	50063	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.682775021 CET	12377	50063	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.682832003 CET	50063	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.683146000 CET	50063	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.684211016 CET	50064	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:29.735820055 CET	12377	50063	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.850102901 CET	12377	50063	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.850399017 CET	12377	50063	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.853984118 CET	12377	50064	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:29.854053020 CET	50064	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.024755955 CET	12377	50064	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.024813890 CET	50064	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.070606947 CET	50064	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.070894003 CET	50064	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.072071075 CET	50065	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.240917921 CET	12377	50064	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.240931988 CET	12377	50064	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.240945101 CET	12377	50065	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.241044044 CET	50065	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.312005997 CET	50065	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.410284996 CET	12377	50065	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.410356998 CET	50065	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.410583973 CET	50065	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.411556959 CET	50066	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.481669903 CET	12377	50065	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.579308987 CET	12377	50065	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.579446077 CET	12377	50065	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.580425978 CET	12377	50066	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.580502987 CET	50066	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.676924944 CET	50066	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.750111103 CET	12377	50066	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.750189066 CET	50066	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.752018929 CET	50066	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.756241083 CET	50067	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.846020937 CET	12377	50066	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.919727087 CET	12377	50066	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.921637058 CET	12377	50066	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.925898075 CET	12377	50067	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:30.927695990 CET	50067	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:30.992917061 CET	50067	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.097137928 CET	12377	50067	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.097502947 CET	50067	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.097589016 CET	50067	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.099133015 CET	50068	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.162463903 CET	12377	50067	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.266616106 CET	12377	50067	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.266638994 CET	12377	50067	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.269623041 CET	12377	50068	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.269798040 CET	50068	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.389802933 CET	50068	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.440200090 CET	12377	50068	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.440269947 CET	50068	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.440888882 CET	50068	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.442528963 CET	50069	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.560199022 CET	12377	50068	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.610529900 CET	12377	50068	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.611002922 CET	12377	50068	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.612582922 CET	12377	50069	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.612658978 CET	50069	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.699520111 CET	50069	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.782810926 CET	12377	50069	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.782913923 CET	50069	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.783107042 CET	50069	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.784889936 CET	50070	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:31.869698048 CET	12377	50069	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.954727888 CET	12377	50069	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.954742908 CET	12377	50069	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.955002069 CET	12377	50070	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:31.955073118 CET	50070	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:32.078538895 CET	50070	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:32.124555111 CET	12377	50070	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:32.124614000 CET	50070	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:32.247437000 CET	12377	50070	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:32.273452997 CET	50070	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:32.275803089 CET	50071	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:32.293495893 CET	12377	50070	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:32.442401886 CET	12377	50070	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:32.445252895 CET	12377	50071	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:32.445334911 CET	50071	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:32.615192890 CET	12377	50071	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:32.615700960 CET	50071	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:33.989433050 CET	50071	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:33.989928007 CET	50071	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:33.990669966 CET	50072	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.159740925 CET	12377	50072	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.159835100 CET	50072	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.161519051 CET	12377	50071	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.161531925 CET	12377	50071	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.255528927 CET	50072	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.328341961 CET	12377	50072	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.328437090 CET	50072	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.328922033 CET	50072	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.329883099 CET	50073	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.425012112 CET	12377	50072	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.497328997 CET	12377	50072	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.497340918 CET	12377	50072	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.500376940 CET	12377	50073	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.500514030 CET	50073	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.553613901 CET	50073	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.670480967 CET	12377	50073	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.670628071 CET	50073	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.671725988 CET	50073	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.672616959 CET	50074	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.724308014 CET	12377	50073	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.840564013 CET	12377	50073	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.841557980 CET	12377	50073	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.842406034 CET	12377	50074	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:34.843461990 CET	50074	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:34.893198967 CET	50074	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.013258934 CET	12377	50074	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.013686895 CET	50074	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.013828039 CET	50074	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.014720917 CET	50075	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.062834024 CET	12377	50074	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.182565928 CET	12377	50075	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.182648897 CET	50075	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.183288097 CET	12377	50074	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.183341026 CET	12377	50074	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.230175018 CET	50075	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.350672007 CET	12377	50075	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.350770950 CET	50075	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.351938009 CET	50075	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.354048967 CET	50076	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.398202896 CET	12377	50075	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.519016027 CET	12377	50075	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.520114899 CET	12377	50075	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.521338940 CET	12377	50076	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.521420956 CET	50076	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.565237045 CET	50076	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.692326069 CET	12377	50076	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.692389011 CET	50076	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.694129944 CET	50076	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.695095062 CET	50077	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.732585907 CET	12377	50076	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.859621048 CET	12377	50076	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.861375093 CET	12377	50076	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.863940954 CET	12377	50077	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:35.865664005 CET	50077	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:35.910741091 CET	50077	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.034734011 CET	12377	50077	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.034792900 CET	50077	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.036086082 CET	50077	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.036984921 CET	50078	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.079670906 CET	12377	50077	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.203547001 CET	12377	50077	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.204826117 CET	12377	50077	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.206901073 CET	12377	50078	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.206970930 CET	50078	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.283453941 CET	50078	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.376971960 CET	12377	50078	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.377046108 CET	50078	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.377257109 CET	50078	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.378290892 CET	50079	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.453435898 CET	12377	50078	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.546431065 CET	12377	50079	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.546541929 CET	50079	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.547507048 CET	12377	50078	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.547523975 CET	12377	50078	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.639914036 CET	50079	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.714329958 CET	12377	50079	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.714389086 CET	50079	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.714550972 CET	50079	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.715331078 CET	50080	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.807631969 CET	12377	50079	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.882791996 CET	12377	50079	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.883001089 CET	12377	50079	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.885068893 CET	12377	50080	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:36.885651112 CET	50080	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:36.923458099 CET	50080	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.055476904 CET	12377	50080	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.056909084 CET	50080	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.058031082 CET	50080	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.059000969 CET	50081	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.093146086 CET	12377	50080	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.226358891 CET	12377	50081	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.226433992 CET	50081	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.226718903 CET	12377	50080	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.227633953 CET	12377	50080	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.290745020 CET	50081	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.394109964 CET	12377	50081	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.394222975 CET	50081	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.394875050 CET	50081	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.396667004 CET	50082	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.458151102 CET	12377	50081	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.561760902 CET	12377	50081	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.562093973 CET	12377	50081	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.565768957 CET	12377	50082	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.565897942 CET	50082	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.639801979 CET	50082	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.735296965 CET	12377	50082	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.735400915 CET	50082	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.736108065 CET	50082	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.741761923 CET	50083	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:37.809252977 CET	12377	50082	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.904424906 CET	12377	50082	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.905214071 CET	12377	50082	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.910160065 CET	12377	50083	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:37.910234928 CET	50083	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.027431011 CET	50083	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.078689098 CET	12377	50083	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.078784943 CET	50083	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.079358101 CET	50083	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.080845118 CET	50084	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.196238041 CET	12377	50083	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.246555090 CET	12377	50083	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.248223066 CET	12377	50083	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.248492956 CET	12377	50084	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.248555899 CET	50084	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.296845913 CET	50084	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.416488886 CET	12377	50084	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.416613102 CET	50084	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.417679071 CET	50084	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.418561935 CET	50085	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.464658022 CET	12377	50084	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.584559917 CET	12377	50084	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.585387945 CET	12377	50084	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.586488962 CET	12377	50085	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.586559057 CET	50085	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.668890953 CET	50085	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.757940054 CET	12377	50085	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.758002996 CET	50085	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.758198977 CET	50085	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.759027004 CET	50086	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.836702108 CET	12377	50085	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.925903082 CET	12377	50085	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.925918102 CET	12377	50085	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.929181099 CET	12377	50086	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:38.929276943 CET	50086	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:38.991309881 CET	50086	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.099591017 CET	12377	50086	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.099725962 CET	50086	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.100255013 CET	50086	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.101382971 CET	50087	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.161662102 CET	12377	50086	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.269988060 CET	12377	50086	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.270222902 CET	12377	50086	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.271514893 CET	12377	50087	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.271795034 CET	50087	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.322113037 CET	50087	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.442622900 CET	12377	50087	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.442706108 CET	50087	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.443869114 CET	50087	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.445008993 CET	50088	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.492199898 CET	12377	50087	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.612728119 CET	12377	50087	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.613862038 CET	12377	50087	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.614780903 CET	12377	50088	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.614869118 CET	50088	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.656033039 CET	50088	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.784733057 CET	12377	50088	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.785643101 CET	50088	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.785868883 CET	50088	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.786837101 CET	50089	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:39.825681925 CET	12377	50088	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.955368042 CET	12377	50088	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.955538988 CET	12377	50089	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.955605030 CET	12377	50088	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:39.955609083 CET	50089	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.058010101 CET	50089	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.124475956 CET	12377	50089	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.124556065 CET	50089	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.125096083 CET	50089	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.126847982 CET	50090	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.229156017 CET	12377	50089	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.293268919 CET	12377	50089	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.293715000 CET	12377	50089	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.295815945 CET	12377	50090	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.295901060 CET	50090	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.364442110 CET	50090	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.464921951 CET	12377	50090	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.464987040 CET	50090	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.467633963 CET	50090	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.469842911 CET	50091	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.535240889 CET	12377	50090	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.633824110 CET	12377	50090	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.636488914 CET	12377	50090	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.637398005 CET	12377	50091	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.637473106 CET	50091	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.698175907 CET	50091	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.805284023 CET	12377	50091	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.805380106 CET	50091	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.806030035 CET	50091	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.807037115 CET	50092	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:40.865793943 CET	12377	50091	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.973819971 CET	12377	50091	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.974226952 CET	12377	50091	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.974834919 CET	12377	50092	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:40.981600046 CET	50092	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.050882101 CET	50092	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.149482965 CET	12377	50092	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.149594069 CET	50092	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.150054932 CET	50092	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.153599024 CET	50093	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.220268965 CET	12377	50092	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.317378044 CET	12377	50092	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.317435026 CET	12377	50092	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.323191881 CET	12377	50093	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.328185081 CET	50093	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.370552063 CET	50093	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.497767925 CET	12377	50093	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.501703978 CET	50093	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.501878977 CET	50093	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.503199100 CET	50094	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.540062904 CET	12377	50093	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.671463966 CET	12377	50093	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.671482086 CET	12377	50093	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.673280001 CET	12377	50094	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.673398972 CET	50094	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.724345922 CET	50094	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.843539000 CET	12377	50094	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:41.843591928 CET	50094	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.843995094 CET	50094	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.852128983 CET	50095	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:41.894259930 CET	12377	50094	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.013499022 CET	12377	50094	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.013847113 CET	12377	50094	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.021734953 CET	12377	50095	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.021820068 CET	50095	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.147885084 CET	50095	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.191476107 CET	12377	50095	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.191549063 CET	50095	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.192059994 CET	50095	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.193495989 CET	50096	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.317430973 CET	12377	50095	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.361042023 CET	12377	50095	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.361712933 CET	12377	50095	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.363435984 CET	12377	50096	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.363509893 CET	50096	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.446680069 CET	50096	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.533620119 CET	12377	50096	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.533694983 CET	50096	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.550793886 CET	50096	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.552442074 CET	50097	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.616668940 CET	12377	50096	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.703989029 CET	12377	50096	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.720705032 CET	12377	50096	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.722187042 CET	12377	50097	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.722280025 CET	50097	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.761044979 CET	50097	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.892198086 CET	12377	50097	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:42.894084930 CET	50097	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.894084930 CET	50097	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.897607088 CET	50098	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:42.930767059 CET	12377	50097	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.063822985 CET	12377	50097	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.063846111 CET	12377	50097	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.067621946 CET	12377	50098	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.069613934 CET	50098	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.129601002 CET	50098	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.239530087 CET	12377	50098	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.241738081 CET	50098	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.243900061 CET	50098	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.243897915 CET	50099	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.299386024 CET	12377	50098	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.411293030 CET	12377	50099	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.411359072 CET	12377	50098	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.411389112 CET	50099	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.413435936 CET	12377	50098	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.468630075 CET	50099	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.578888893 CET	12377	50099	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.579121113 CET	50099	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.579265118 CET	50099	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.580297947 CET	50100	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.635982990 CET	12377	50099	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.746447086 CET	12377	50099	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.746468067 CET	12377	50099	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.749083996 CET	12377	50100	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.749592066 CET	50100	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.801621914 CET	50100	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.918677092 CET	12377	50100	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:43.918783903 CET	50100	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.919054985 CET	50100	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.920049906 CET	50101	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:43.970495939 CET	12377	50100	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.087768078 CET	12377	50101	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.087794065 CET	12377	50100	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.087805986 CET	12377	50100	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.087842941 CET	50101	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.188697100 CET	50101	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.255811930 CET	12377	50101	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.255875111 CET	50101	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.260530949 CET	50101	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.298675060 CET	50102	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.356513023 CET	12377	50101	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.423651934 CET	12377	50101	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.428234100 CET	12377	50101	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.466036081 CET	12377	50102	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.466171980 CET	50102	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.533282995 CET	50102	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.634143114 CET	12377	50102	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.634311914 CET	50102	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.634720087 CET	50102	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.640032053 CET	50103	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.700850964 CET	12377	50102	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.801706076 CET	12377	50102	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.802124023 CET	12377	50102	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.809796095 CET	12377	50103	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.809881926 CET	50103	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.865612984 CET	50103	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.979787111 CET	12377	50103	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:44.982462883 CET	50103	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.982462883 CET	50103	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:44.985608101 CET	50104	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.035175085 CET	12377	50103	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.152774096 CET	12377	50103	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.152797937 CET	12377	50103	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.154202938 CET	12377	50104	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.154347897 CET	50104	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.234988928 CET	50104	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.323689938 CET	12377	50104	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.323854923 CET	50104	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.323998928 CET	50104	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.325066090 CET	50105	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.405209064 CET	12377	50104	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.495100021 CET	12377	50104	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.495114088 CET	12377	50104	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.495317936 CET	12377	50105	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.495393038 CET	50105	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.574906111 CET	50105	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.663471937 CET	12377	50105	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.667082071 CET	50105	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.667082071 CET	50105	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.669617891 CET	50106	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.742594957 CET	12377	50105	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.834752083 CET	12377	50105	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.834770918 CET	12377	50105	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.839559078 CET	12377	50106	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:45.839634895 CET	50106	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:45.902723074 CET	50106	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.009752035 CET	12377	50106	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.009882927 CET	50106	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.010328054 CET	50106	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.011279106 CET	50107	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.072767973 CET	12377	50106	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.179888010 CET	12377	50106	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.180172920 CET	12377	50106	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.180234909 CET	12377	50107	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.180303097 CET	50107	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.263484001 CET	50107	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.349462032 CET	12377	50107	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.349520922 CET	50107	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.349653959 CET	50107	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.351104021 CET	50108	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.432457924 CET	12377	50107	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.518623114 CET	12377	50107	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.518692970 CET	12377	50107	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.519897938 CET	12377	50108	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.519970894 CET	50108	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.579513073 CET	50108	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.688833952 CET	12377	50108	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.688899994 CET	50108	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.689033985 CET	50108	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.690283060 CET	50109	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.748177052 CET	12377	50108	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.857494116 CET	12377	50108	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.857526064 CET	12377	50108	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.858993053 CET	12377	50109	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:46.859175920 CET	50109	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:46.978913069 CET	50109	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.027884960 CET	12377	50109	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.028163910 CET	50109	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.028345108 CET	50109	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.029105902 CET	50110	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.147608042 CET	12377	50109	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.196608067 CET	12377	50109	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.196748972 CET	12377	50109	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.197611094 CET	12377	50110	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.197731018 CET	50110	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.243494987 CET	50110	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.366492033 CET	12377	50110	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.366693974 CET	50110	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.366794109 CET	50110	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.367711067 CET	50111	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.412041903 CET	12377	50110	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.535363913 CET	12377	50110	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.535381079 CET	12377	50110	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.537303925 CET	12377	50111	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.537405968 CET	50111	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.592989922 CET	50111	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.707078934 CET	12377	50111	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.707207918 CET	50111	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.707879066 CET	50111	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.708482027 CET	50112	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.762940884 CET	12377	50111	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.876748085 CET	12377	50111	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.877435923 CET	12377	50111	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.878441095 CET	12377	50112	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:47.878509998 CET	50112	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:47.936901093 CET	50112	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.048590899 CET	12377	50112	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.048671007 CET	50112	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.049242973 CET	50112	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.050538063 CET	50113	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.106826067 CET	12377	50112	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.218157053 CET	12377	50113	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.218219995 CET	50113	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.218676090 CET	12377	50112	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.219319105 CET	12377	50112	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.287348986 CET	50113	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.385797977 CET	12377	50113	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.385862112 CET	50113	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.386023045 CET	50113	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.386960030 CET	50114	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.454725027 CET	12377	50113	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.557153940 CET	12377	50113	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.557185888 CET	12377	50113	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.558559895 CET	12377	50114	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.558630943 CET	50114	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.617566109 CET	50114	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.727461100 CET	12377	50114	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.727520943 CET	50114	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.727706909 CET	50114	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.728811979 CET	50115	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:48.786358118 CET	12377	50114	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.896106958 CET	12377	50114	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.896245003 CET	12377	50114	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.898672104 CET	12377	50115	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:48.901827097 CET	50115	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:49.071779013 CET	12377	50115	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:49.071902037 CET	50115	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:49.179069996 CET	50115	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:49.181009054 CET	50115	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:49.235295057 CET	50116	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:49.348751068 CET	12377	50115	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:49.350601912 CET	12377	50115	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:49.404272079 CET	12377	50116	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:49.404443979 CET	50116	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:49.573405981 CET	12377	50116	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:49.573714018 CET	50116	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.005353928 CET	50116	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.005812883 CET	50116	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.007230997 CET	50117	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.174223900 CET	12377	50116	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.174549103 CET	12377	50116	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.174648046 CET	12377	50117	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.174716949 CET	50117	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.333935976 CET	50117	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.342216015 CET	12377	50117	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.342294931 CET	50117	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.342623949 CET	50117	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.343373060 CET	50118	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.501391888 CET	12377	50117	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.510010958 CET	12377	50117	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.510130882 CET	12377	50117	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.513603926 CET	12377	50118	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.513686895 CET	50118	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.589148998 CET	50118	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.683964968 CET	12377	50118	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.684125900 CET	50118	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.694478989 CET	50118	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.695724964 CET	50119	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.759219885 CET	12377	50118	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.854458094 CET	12377	50118	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.864423037 CET	12377	50118	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.864712000 CET	12377	50119	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:51.864820004 CET	50119	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:51.948321104 CET	50119	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.034030914 CET	12377	50119	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.037777901 CET	50119	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.037811995 CET	50119	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.038851976 CET	50120	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.117350101 CET	12377	50119	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.206578016 CET	12377	50120	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.206660986 CET	50120	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.206758976 CET	12377	50119	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.206772089 CET	12377	50119	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.266879082 CET	50120	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.374600887 CET	12377	50120	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.374667883 CET	50120	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.374887943 CET	50120	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.375803947 CET	50121	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.434545994 CET	12377	50120	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.545484066 CET	12377	50120	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.545965910 CET	12377	50120	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.546485901 CET	12377	50121	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.546560049 CET	50121	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.604024887 CET	50121	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.714250088 CET	12377	50121	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.714325905 CET	50121	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.717772961 CET	50121	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.718698025 CET	50122	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.771576881 CET	12377	50121	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.881958008 CET	12377	50121	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.885298014 CET	12377	50121	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.885901928 CET	12377	50122	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:52.885986090 CET	50122	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:52.980609894 CET	50122	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.053498030 CET	12377	50122	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.053670883 CET	50122	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.053860903 CET	50122	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.054788113 CET	50123	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.147983074 CET	12377	50122	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.220890999 CET	12377	50122	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.220997095 CET	12377	50122	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.224364996 CET	12377	50123	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.224455118 CET	50123	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.302160025 CET	50123	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.394439936 CET	12377	50123	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.394507885 CET	50123	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.394985914 CET	50123	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.396349907 CET	50124	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.471913099 CET	12377	50123	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.564317942 CET	12377	50123	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.564743996 CET	12377	50123	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.566221952 CET	12377	50124	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.566298008 CET	50124	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.616000891 CET	50124	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.736414909 CET	12377	50124	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.737304926 CET	50124	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.737732887 CET	50124	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.738960981 CET	50125	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.790733099 CET	12377	50124	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.910825968 CET	12377	50125	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.910847902 CET	12377	50124	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.910914898 CET	50125	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:53.911506891 CET	12377	50124	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:53.980413914 CET	50125	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.078859091 CET	12377	50125	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.080424070 CET	50125	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.080966949 CET	50125	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.082098007 CET	50126	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.148330927 CET	12377	50125	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.248312950 CET	12377	50125	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.249161959 CET	12377	50125	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.250171900 CET	12377	50126	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.250238895 CET	50126	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.297538042 CET	50126	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.418070078 CET	12377	50126	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.418138981 CET	50126	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.425319910 CET	50126	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.426574945 CET	50127	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.465235949 CET	12377	50126	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.585854053 CET	12377	50126	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.593081951 CET	12377	50126	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.594446898 CET	12377	50127	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.594532013 CET	50127	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.656699896 CET	50127	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.762399912 CET	12377	50127	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.762470007 CET	50127	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.763053894 CET	50127	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.764595032 CET	50128	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:54.824368000 CET	12377	50127	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.930038929 CET	12377	50127	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.930727959 CET	12377	50127	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.931947947 CET	12377	50128	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:54.932044029 CET	50128	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.002794027 CET	50128	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.099680901 CET	12377	50128	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.100424051 CET	50128	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.101208925 CET	50128	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.102133989 CET	50129	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.170589924 CET	12377	50128	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.267909050 CET	12377	50128	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.268471003 CET	12377	50128	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.270770073 CET	12377	50129	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.270853043 CET	50129	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.348052979 CET	50129	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.439872026 CET	12377	50129	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.439941883 CET	50129	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.443662882 CET	50129	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.448224068 CET	50130	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.516886950 CET	12377	50129	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.608726978 CET	12377	50129	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.612317085 CET	12377	50129	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.617999077 CET	12377	50130	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.618082047 CET	50130	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.676309109 CET	50130	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.788058043 CET	12377	50130	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.788130045 CET	50130	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.791112900 CET	50130	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.792223930 CET	50131	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:55.846302986 CET	12377	50130	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.957969904 CET	12377	50130	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.960845947 CET	12377	50130	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.961481094 CET	12377	50131	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:55.961587906 CET	50131	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.061355114 CET	50131	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.131136894 CET	12377	50131	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.132950068 CET	50131	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.133759022 CET	50131	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.134783983 CET	50132	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.230828047 CET	12377	50131	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.303855896 CET	12377	50131	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.304153919 CET	12377	50131	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.304902077 CET	12377	50132	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.304989100 CET	50132	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.349797964 CET	50132	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.476383924 CET	12377	50132	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.476479053 CET	50132	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.478182077 CET	50132	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.488476992 CET	50133	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.519676924 CET	12377	50132	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.646603107 CET	12377	50132	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.648194075 CET	12377	50132	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.658541918 CET	12377	50133	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.658618927 CET	50133	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.737400055 CET	50133	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.828672886 CET	12377	50133	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.828773022 CET	50133	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.830019951 CET	50133	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.831229925 CET	50134	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:56.907756090 CET	12377	50133	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.998415947 CET	12377	50133	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:56.999483109 CET	12377	50133	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.001791000 CET	12377	50134	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.005666018 CET	50134	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.055951118 CET	50134	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.177778006 CET	12377	50134	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.179960966 CET	50134	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.181157112 CET	50134	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.182063103 CET	50135	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.225151062 CET	12377	50134	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.348881006 CET	12377	50134	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.349960089 CET	12377	50134	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.351461887 CET	12377	50135	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.351560116 CET	50135	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.435101032 CET	50135	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.521408081 CET	12377	50135	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.521514893 CET	50135	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.526038885 CET	50135	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.527079105 CET	50136	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.604625940 CET	12377	50135	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.691087961 CET	12377	50135	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.694772959 CET	12377	50136	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.694855928 CET	50136	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.695375919 CET	12377	50135	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.755247116 CET	50136	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.862773895 CET	12377	50136	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:57.862849951 CET	50136	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.863178968 CET	50136	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.867396116 CET	50137	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:57.922889948 CET	12377	50136	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.030519962 CET	12377	50136	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.030668974 CET	12377	50136	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.036401987 CET	12377	50137	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.037707090 CET	50137	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.081582069 CET	50137	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.206847906 CET	12377	50137	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.209726095 CET	50137	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.210076094 CET	50137	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.211090088 CET	50138	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.250737906 CET	12377	50137	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.379082918 CET	12377	50138	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.379183054 CET	50138	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.379297972 CET	12377	50137	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.379878998 CET	12377	50137	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.509910107 CET	50138	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.548044920 CET	12377	50138	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.549670935 CET	50138	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.550442934 CET	50138	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.551639080 CET	50139	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.677695036 CET	12377	50138	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.717377901 CET	12377	50138	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.718278885 CET	12377	50138	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.721364975 CET	12377	50139	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.721435070 CET	50139	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.891299009 CET	12377	50139	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:58.891701937 CET	50139	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.917316914 CET	50139	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.918066025 CET	50139	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:58.918842077 CET	50140	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.087030888 CET	12377	50139	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.087630033 CET	12377	50139	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.088260889 CET	12377	50140	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.091707945 CET	50140	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.158456087 CET	50140	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.271631002 CET	12377	50140	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.271718979 CET	50140	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.271944046 CET	50140	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.273449898 CET	50141	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.328020096 CET	12377	50140	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.441220045 CET	12377	50140	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.441313982 CET	12377	50140	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.442523956 CET	12377	50141	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.442609072 CET	50141	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.486562967 CET	50141	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.612097979 CET	12377	50141	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.612174034 CET	50141	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.614851952 CET	50141	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.624444962 CET	50142	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.655797005 CET	12377	50141	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.781217098 CET	12377	50141	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.784225941 CET	12377	50141	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.794127941 CET	12377	50142	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.794203043 CET	50142	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.913896084 CET	50142	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.963957071 CET	12377	50142	3.66.38.117	192.168.2.7
Mar 20, 2024 11:35:59.964092970 CET	50142	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.964651108 CET	50142	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:35:59.965728998 CET	50143	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.084213972 CET	12377	50142	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.133698940 CET	12377	50142	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.133717060 CET	12377	50143	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.133816957 CET	50143	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.134166956 CET	12377	50142	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.175278902 CET	50143	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.301820040 CET	12377	50143	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.301882982 CET	50143	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.302100897 CET	50143	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.303024054 CET	50144	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.343149900 CET	12377	50143	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.469764948 CET	12377	50143	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.469958067 CET	12377	50143	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.471988916 CET	12377	50144	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.472095966 CET	50144	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.558131933 CET	50144	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.641405106 CET	12377	50144	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.641488075 CET	50144	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.641788006 CET	50144	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.643397093 CET	50145	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.727247953 CET	12377	50144	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.810408115 CET	12377	50144	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.810925961 CET	12377	50144	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.813142061 CET	12377	50145	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.813230038 CET	50145	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.862524033 CET	50145	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.983022928 CET	12377	50145	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:00.983100891 CET	50145	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.983335972 CET	50145	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:00.984183073 CET	50146	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.032166004 CET	12377	50145	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.153130054 CET	12377	50145	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.153146029 CET	12377	50145	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.153419971 CET	12377	50146	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.153656960 CET	50146	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.212368965 CET	50146	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.322796106 CET	12377	50146	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.322863102 CET	50146	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.323090076 CET	50146	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.324132919 CET	50147	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.381629944 CET	12377	50146	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.491930008 CET	12377	50146	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.491950989 CET	12377	50147	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.492010117 CET	12377	50146	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.492044926 CET	50147	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.544029951 CET	50147	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.661797047 CET	12377	50147	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.661858082 CET	50147	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.669255972 CET	50147	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.670193911 CET	50148	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.711792946 CET	12377	50147	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.829730988 CET	12377	50147	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.836967945 CET	12377	50147	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.838792086 CET	12377	50148	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:01.838885069 CET	50148	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:01.883404970 CET	50148	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.007690907 CET	12377	50148	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.007882118 CET	50148	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.008148909 CET	50148	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.009104967 CET	50149	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.052114010 CET	12377	50148	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.176570892 CET	12377	50148	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.176668882 CET	12377	50148	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.179321051 CET	12377	50149	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.180569887 CET	50149	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.225126028 CET	50149	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.350310087 CET	12377	50149	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.350389004 CET	50149	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.351061106 CET	50149	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.351881981 CET	50150	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.394722939 CET	12377	50149	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.519304991 CET	12377	50150	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.519402981 CET	50150	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.519896984 CET	12377	50149	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.520512104 CET	12377	50149	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.577310085 CET	50150	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.687232971 CET	12377	50150	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.687302113 CET	50150	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.687632084 CET	50150	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.688738108 CET	50151	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:02.744858027 CET	12377	50150	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.854897022 CET	12377	50150	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.855014086 CET	12377	50150	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.856730938 CET	12377	50151	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:02.856897116 CET	50151	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:03.029637098 CET	12377	50151	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:03.029700041 CET	50151	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:03.823872089 CET	50151	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:03.870281935 CET	50151	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:03.871198893 CET	50152	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:03.990994930 CET	12377	50151	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:04.037518024 CET	12377	50151	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:04.039828062 CET	12377	50152	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:04.039906979 CET	50152	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:04.208647966 CET	12377	50152	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:04.209655046 CET	50152	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:04.681634903 CET	50152	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:04.682670116 CET	50152	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:04.684050083 CET	50153	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:04.850253105 CET	12377	50152	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:04.851278067 CET	12377	50152	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:04.852894068 CET	12377	50153	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:04.857717037 CET	50153	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:04.906053066 CET	50153	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.026856899 CET	12377	50153	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.027017117 CET	50153	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.027456999 CET	50153	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.029421091 CET	50154	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.074947119 CET	12377	50153	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.196053028 CET	12377	50153	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.196376085 CET	12377	50153	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.197316885 CET	12377	50154	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.197453976 CET	50154	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.260617018 CET	50154	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.365597010 CET	12377	50154	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.365678072 CET	50154	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.366748095 CET	50154	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.368406057 CET	50155	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.428523064 CET	12377	50154	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.533546925 CET	12377	50154	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.534739017 CET	12377	50154	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.537039995 CET	12377	50155	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.537106991 CET	50155	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.605614901 CET	50155	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.705770969 CET	12377	50155	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.705845118 CET	50155	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.706532955 CET	50155	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.707503080 CET	50156	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.774358988 CET	12377	50155	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.874556065 CET	12377	50155	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.875262022 CET	12377	50155	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.877159119 CET	12377	50156	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:05.877706051 CET	50156	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:05.926776886 CET	50156	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:06.047281981 CET	12377	50156	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:06.049715996 CET	50156	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:06.051594019 CET	50156	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:06.052556038 CET	50157	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:06.096204042 CET	12377	50156	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:06.219193935 CET	12377	50156	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:06.221024990 CET	12377	50156	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:06.221069098 CET	12377	50157	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:06.221271992 CET	50157	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:06.389934063 CET	12377	50157	3.66.38.117	192.168.2.7
Mar 20, 2024 11:36:06.389981031 CET	50157	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:08.965711117 CET	50157	12377	192.168.2.7	3.66.38.117
Mar 20, 2024 11:36:09.134391069 CET	12377	50157	3.66.38.117	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2024 11:32:15.108525991 CET	62277	53	192.168.2.7	1.1.1.1
Mar 20, 2024 11:32:15.219697952 CET	53	62277	1.1.1.1	192.168.2.7
Mar 20, 2024 11:33:16.463567019 CET	49712	53	192.168.2.7	1.1.1.1
Mar 20, 2024 11:33:16.554708004 CET	53	49712	1.1.1.1	192.168.2.7
Mar 20, 2024 11:34:16.788398981 CET	63536	53	192.168.2.7	1.1.1.1
Mar 20, 2024 11:34:16.884021997 CET	53	63536	1.1.1.1	192.168.2.7
Mar 20, 2024 11:35:16.875715971 CET	52421	53	192.168.2.7	1.1.1.1
Mar 20, 2024 11:35:16.984256983 CET	53	52421	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2024 11:32:15.108525991 CET	192.168.2.7	1.1.1.1	0x8b7a	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Mar 20, 2024 11:33:16.463567019 CET	192.168.2.7	1.1.1.1	0xf9ab	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Mar 20, 2024 11:34:16.788398981 CET	192.168.2.7	1.1.1.1	0x4635	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Mar 20, 2024 11:35:16.875715971 CET	192.168.2.7	1.1.1.1	0x30e5	Standard query (0)	6.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 20, 2024 11:32:15.219697952 CET	1.1.1.1	192.168.2.7	0x8b7a	No error (0)	6.tcp.eu.ngrok.io	52.28.247.255	A (IP address)	IN (0x0001)	false
Mar 20, 2024 11:33:16.554708004 CET	1.1.1.1	192.168.2.7	0xf9ab	No error (0)	6.tcp.eu.ngrok.io	3.68.171.119	A (IP address)	IN (0x0001)	false
Mar 20, 2024 11:34:16.884021997 CET	1.1.1.1	192.168.2.7	0x4635	No error (0)	6.tcp.eu.ngrok.io	18.197.239.109	A (IP address)	IN (0x0001)	false
Mar 20, 2024 11:35:16.984256983 CET	1.1.1.1	192.168.2.7	0x30e5	No error (0)	6.tcp.eu.ngrok.io	3.66.38.117	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	11:31:58
Start date:	20/03/2024
Path:	C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe"
Imagebase:	0x3d0000
File size:	44'032 bytes
MD5 hash:	760C3907F64EA9FB60E13D4847C083A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000001.00000000.1263686683.00000000003D2000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000001.00000002.1329226878.000000000275C000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:32:05
Start date:	20/03/2024
Path:	C:\Users\user\AppData\Local\Temp\system.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\system.exe"
Imagebase:	0xeb0000
File size:	44'032 bytes
MD5 hash:	760C3907F64EA9FB60E13D4847C083A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Local\Temp\system.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\system.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Local\Temp\system.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Local\Temp\system.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs Detection: 82%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00EA82ED Relevance: 2.4, Instructions: 2416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2c8d5962453b0c64a9359451c3020038beae2829165cd4f0a4b3439d65562c
Instruction ID: d751b62ea910101c8c1b1d99e87d6c9502a328df14e06afa1d844a1c1dde99fe
Opcode Fuzzy Hash: ca2c8d5962453b0c64a9359451c3020038beae2829165cd4f0a4b3439d65562c
Instruction Fuzzy Hash: 55238E3AA103108FE72AEF30D85679877B6EB89341F4485A9D405DB2E5CBB9EE44CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA5889 Relevance: 1.9, Instructions: 1942COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5155cccde62a96f9a752b1314ad5f4676719c522929e9551fa9a8c638c8ab9b
Instruction ID: b719950f3e58b783546023d6dc530b48542135da8a9c67ec4e8ff1ded0713b53
Opcode Fuzzy Hash: b5155cccde62a96f9a752b1314ad5f4676719c522929e9551fa9a8c638c8ab9b
Instruction Fuzzy Hash: 66035E3AA103108FE71AAF30D8553983BB6AF49342F4485A9D446DB2E5CFB9DE85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA4917 Relevance: 1.7, Strings: 1, Instructions: 463COMMON

Download Yara Rule

Strings

dq, xrefs: 00EA4BFD

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID: dq
API String ID: 0-4057445327
Opcode ID: 9e5afe28d4f83502008eea2383b9b261eb087a6321da8a4843d0bbc33ac39a7f
Instruction ID: 6e9ec74639e3dd4931607c938656cde3489937ca6d2154325bb3108683bcde70
Opcode Fuzzy Hash: 9e5afe28d4f83502008eea2383b9b261eb087a6321da8a4843d0bbc33ac39a7f
Instruction Fuzzy Hash: E4222B74A00314CFDB29EF34D854BA97BB2FB49301F1085A9E909AB3A5DBB59D81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA4343 Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

Teq, xrefs: 00EA44D2

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 20e81465a4fc1ad39fc2124b1451927c06c2df6fca4c74ee6b216d6a741535d7
Instruction ID: 5eeaeaadc45ef3f912375ff7d5fe0626cf02844d046b42c5a4c373c49f4a847a
Opcode Fuzzy Hash: 20e81465a4fc1ad39fc2124b1451927c06c2df6fca4c74ee6b216d6a741535d7
Instruction Fuzzy Hash: 09613178A003459FEB1AFF78E880A8977F1FB55354700DA55D0049F27ADBF86906CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA4390 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

Teq, xrefs: 00EA44D2

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 17aafd2fd6a2c9f605589fe9df89aa92da5f13a90af3d0280d126209ea9fa001
Instruction ID: 3a343151c45b10fde3fb38aa8cf306bd3deddff8a3fe30a078197877d480b4a1
Opcode Fuzzy Hash: 17aafd2fd6a2c9f605589fe9df89aa92da5f13a90af3d0280d126209ea9fa001
Instruction Fuzzy Hash: 3C51FD38A00345DFEB1AEF78E980A8977F1FB54644700DA54D0059B23ADBB86D16CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA43A0 Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

Teq, xrefs: 00EA44D2

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 46ea98c7204ea31a5c93ccc264412ed03c1c546c918c692773591668f18cf80e
Instruction ID: 81914c319457c77958781712efd8b8eef25017eb3fde9b07f5a3bc51dd61fe5c
Opcode Fuzzy Hash: 46ea98c7204ea31a5c93ccc264412ed03c1c546c918c692773591668f18cf80e
Instruction Fuzzy Hash: BC51BD38A00345DFEB5AFF78E980A8977F1FB54644700DA64D0059B22ADBF86D16CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0DCF Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

4'q, xrefs: 00EA0DA8

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID: 4'q
API String ID: 0-1807707664
Opcode ID: c14651876a17dc76652749a8e2c44d2bba4cbfb1f56571a0d96c0d986a5f50a7
Instruction ID: 6089c602af0eea83246a06a3bb9f48b72d63d70370fed3a0d65de91c87686c62
Opcode Fuzzy Hash: c14651876a17dc76652749a8e2c44d2bba4cbfb1f56571a0d96c0d986a5f50a7
Instruction Fuzzy Hash: D331E434A053058FD726EB78D41179E3BE2EF82344B048A6DD0056F3A5DFB4AD09CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA92F8 Relevance: .7, Instructions: 710COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f28e562247b4c06071916df252e2b906aec1abc85d8dad210193a29491d814
Instruction ID: 0646b9e1c3246a7e3c87743ec5cb39a5daa2e5ba9195ed42c3bf35010e992964
Opcode Fuzzy Hash: b3f28e562247b4c06071916df252e2b906aec1abc85d8dad210193a29491d814
Instruction Fuzzy Hash: 34F1EC78A00314CFDB29EF34D954BA9B7B2FB49300F1085A9D90AAB365DB75AD81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA9608 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d735ffd9078b4d512f139d58fe9d26e79df54334407d9b62b64d1d60559e1f0b
Instruction ID: a41ffa842413750894634c7969c35856fa3f3de907b62df895e6557cc3742167
Opcode Fuzzy Hash: d735ffd9078b4d512f139d58fe9d26e79df54334407d9b62b64d1d60559e1f0b
Instruction Fuzzy Hash: 4FF1FD78A00314CFDB29EF34D954B69B7B2FB49300F1085A9D90AAB365DB75AD81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EA3DF0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be66854b8278b0cf2771e1f85e07ad1271ff933dfe0941bab68ec66332869a2f
Instruction ID: 00f665207d64da8705907d59ec301d05f4c221434a6becc77a2cd41a23338ae0
Opcode Fuzzy Hash: be66854b8278b0cf2771e1f85e07ad1271ff933dfe0941bab68ec66332869a2f
Instruction Fuzzy Hash: 63419334B003148FE719EF74D8157AE3BA6AB89740F108069E405DB3A9DF789D16CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00EA3E00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fb77c628e9ec5b930b33e50866db20c142f08356ea6a4cb339730ada5ade874
Instruction ID: 5c48cc4a90b3f684d3072fd041ec67ee18648df8e58694b2df18ca82596dce73
Opcode Fuzzy Hash: 5fb77c628e9ec5b930b33e50866db20c142f08356ea6a4cb339730ada5ade874
Instruction Fuzzy Hash: 50318134B003148FE719FF74D8157AE7BEAEB88740F108468E1059B3A9DF789D068BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0890 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d4a269a35831520ab0d1bc9085bafa952ed26a5eae3e3aa1a1af5a0016a793
Instruction ID: 623a60d78b697504d63c135ff521f444a22a2e49f5704f21d69802aedd617b37
Opcode Fuzzy Hash: 68d4a269a35831520ab0d1bc9085bafa952ed26a5eae3e3aa1a1af5a0016a793
Instruction Fuzzy Hash: 4031BCB19003088FDB14DFB9C845B9EBBF5EF89324F108469E014BB251D735A840CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0994 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7651bb882a286049730fcebf90a7cbafe0dea1a971ad38305b5ad33a9fd6cb7f
Instruction ID: e3f5bd35df7c1deafdc130d7dd641f65bbccaf9c705a6221fb2cab163e05fe08
Opcode Fuzzy Hash: 7651bb882a286049730fcebf90a7cbafe0dea1a971ad38305b5ad33a9fd6cb7f
Instruction Fuzzy Hash: 793101B5D01248DFDB14CFA9C584BCEBBF1AF49304F24802AE408BB361C7756945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00EA09A0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a45a6e73796f4b3f5f667b5626aeb8a6650adba1a378a28f9cd032848db87e7
Instruction ID: ad8f3f5668c6b5f3c944b00f6e3abfea3ab748d3eef8d6e2e6cc0ab876566ec6
Opcode Fuzzy Hash: 4a45a6e73796f4b3f5f667b5626aeb8a6650adba1a378a28f9cd032848db87e7
Instruction Fuzzy Hash: 5031EFB1D01248DFDB24CFA9D584BCDBBF5AF49314F20802AE409BB350CB75A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00EA3CE9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75cad3a9510b325e600a5626c3199d138fb69b8deb1c215116f8346bd59f667c
Instruction ID: 607497d472808ed7eb554f21399c4d2a01630ffecc0ef8e186dd01dbf5fe81ce
Opcode Fuzzy Hash: 75cad3a9510b325e600a5626c3199d138fb69b8deb1c215116f8346bd59f667c
Instruction Fuzzy Hash: BB21A47490020AAFEB15EF74E8415EEBBF5EF85300F1045A9E001AB2A1DFB0AA05CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EAA0A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e265c2c42f5d1be791cac5f31fce8655001bb38a7b9fc90132e10a9027cbd9bf
Instruction ID: 0cf712e83313d56114a34bcca639643684ebe0235fe56a998df9433ec821711c
Opcode Fuzzy Hash: e265c2c42f5d1be791cac5f31fce8655001bb38a7b9fc90132e10a9027cbd9bf
Instruction Fuzzy Hash: BA0147367023100BE7342778B4543A937D2DB8A6153084479E906EB244EF7AEC0383A2

Uniqueness

Uniqueness Score: -1.00%

Function 00EA3CF8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee55e0dc6624356e1538229a9b4c0f23297dd4d34b5879f0e14db85af80458d9
Instruction ID: 0c09912acd1a15d304fea4b037fa7ed93fb37bd211b1974df659695b384b48e9
Opcode Fuzzy Hash: ee55e0dc6624356e1538229a9b4c0f23297dd4d34b5879f0e14db85af80458d9
Instruction Fuzzy Hash: D0114F34E0020AABDB05EFB4E8456AEB7F5EF85710F104569E105A7360DFB06A45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0DE0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3946e2f1924e22a6243405da360942ae4dd9c230ec4de9a7376acf403d11dcd0
Instruction ID: e6261ed9cb212a01ed71c24899d529862c756dcaa07704e4ab5cc926053eaadf
Opcode Fuzzy Hash: 3946e2f1924e22a6243405da360942ae4dd9c230ec4de9a7376acf403d11dcd0
Instruction Fuzzy Hash: 2E11C2356003008BE365FB28D41179A3BD2BF81394B148A2DD0055F7A4DFB9ED09CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA08F8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05df9b7fe6b08c26599a03bc6a406c508cefb5c1eb51a492061bed18c96a700e
Instruction ID: d805fe0613aa201aa1f4c5d69e431a25f168654166ddeeb784053d893ce1a2da
Opcode Fuzzy Hash: 05df9b7fe6b08c26599a03bc6a406c508cefb5c1eb51a492061bed18c96a700e
Instruction Fuzzy Hash: FE1110B5C006098FDB20CFAAC584B9EFBF0AB88324F20841AD419A7751C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0900 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d659e5319a8a5ef447c7eefa675846fa4d3dfbf866eb6e8160ebf90dcf2614d
Instruction ID: 8c7ca334b0ef01b93fc9c8e5dc5e33d4ef9a5ac0c563ac90b2da5bd51ff09fcf
Opcode Fuzzy Hash: 7d659e5319a8a5ef447c7eefa675846fa4d3dfbf866eb6e8160ebf90dcf2614d
Instruction Fuzzy Hash: DC1103B5C007498FDB20DFAAC444BDEFBF4AB88314F20841AD419A7751C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00EA8FA8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beccbc3cab788bf8fecc771e6ec83638af6b47067595b14316c78d1aa9643518
Instruction ID: b8534fe27e268f45557579f726f2d018a8ba7a9080174d315fc981d2098ec1da
Opcode Fuzzy Hash: beccbc3cab788bf8fecc771e6ec83638af6b47067595b14316c78d1aa9643518
Instruction Fuzzy Hash: 2D019E34B082948FEB11DB78D4507587BE1AF4A220F11429DE4A18F3A1E730AC41CB83

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0880 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0977178eaea1cf2679152a0d0cbfe532ffc441052bec29eb04753ce675f18793
Instruction ID: 57490876ec95b9661131a2e22c034a255c21843088328d5736dc93c737623488
Opcode Fuzzy Hash: 0977178eaea1cf2679152a0d0cbfe532ffc441052bec29eb04753ce675f18793
Instruction Fuzzy Hash: 9DF0F671A04304AFCB0DDB708C4519E3B63EF8F320F0495A9E004FF2A1D939A8508798

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0EA0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de2fb3d0ebab5a161d6ed9f966609e7595b305f5fb3f474c71e79cf817d407f8
Instruction ID: 72320c0f5e67e28a55a7b5e261869bad9ad66ca229ee2505246d85e734b247ed
Opcode Fuzzy Hash: de2fb3d0ebab5a161d6ed9f966609e7595b305f5fb3f474c71e79cf817d407f8
Instruction Fuzzy Hash: E8F0A7766093004FD7156778A8213A53BE2EEC639135485AED045DF664DFA8D903C3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EAA032 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb50ae26c70f78bb74f3262ae3fcaa05a4c8ae35ddf783d0ab3f90767ce5b06
Instruction ID: a4b518d9c44e0b2c4fca9e80b7bdd16058b7bfeca2843e453046eaac7f4f4c0d
Opcode Fuzzy Hash: 7fb50ae26c70f78bb74f3262ae3fcaa05a4c8ae35ddf783d0ab3f90767ce5b06
Instruction Fuzzy Hash: 9CE02036F053085BDF11EFF4A5102EDBB61DB85614B044DAAC50ADB140DA718E1047A3

Uniqueness

Uniqueness Score: -1.00%

Function 00EAA068 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6ec482e3215f8bc869dc25bf286e3f101d01db1766e75d57b6a9292fbbfaf44
Instruction ID: 490328e40eee1f0d76768a4265a2ce28a01bb2edf310319b3fa39e8f2cad6a8b
Opcode Fuzzy Hash: b6ec482e3215f8bc869dc25bf286e3f101d01db1766e75d57b6a9292fbbfaf44
Instruction Fuzzy Hash: 48E0C2B1A0A3448FDB16DB705A6025E3BA18F4520030509EA8406DF182EE35CA0486A7

Uniqueness

Uniqueness Score: -1.00%

Function 00EAA038 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf81e861d9f73f7ecc2eb4ce831db56bbd93a50a91a2a2a7c4e2e16d906869f6
Instruction ID: 4b8b4207e92554c272d92e0f163cde649c2c8b1cbbf89f04b2015d8d0454e016
Opcode Fuzzy Hash: bf81e861d9f73f7ecc2eb4ce831db56bbd93a50a91a2a2a7c4e2e16d906869f6
Instruction Fuzzy Hash: BAD0A771A0130C57DB14EFB4461036E769ACB445007004D699806D7240ED71DE0046B7

Uniqueness

Uniqueness Score: -1.00%

Function 00EAA078 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42598c98ac2e7808bc0f070db8ee6753dda25dc35776af1e0e45e5bbd04474bb
Instruction ID: 8308b73f7b9ecc49a6c81fd796a226c8f0d4cd17ad8cbb161a8e800caeec6d19
Opcode Fuzzy Hash: 42598c98ac2e7808bc0f070db8ee6753dda25dc35776af1e0e45e5bbd04474bb
Instruction Fuzzy Hash: 68D012397123148BC7252774A51C55977E9EB4DA22300547EE806C3344DEFBCC018790

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0839 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7bbb08f8ae6575f223b2288bcba8c90d258f173a8b6ba454e0dd14e8ef32ce5
Instruction ID: caa34e089d752d49bde592041fdec049609edef548919e01b73da8d701d21fc4
Opcode Fuzzy Hash: b7bbb08f8ae6575f223b2288bcba8c90d258f173a8b6ba454e0dd14e8ef32ce5
Instruction Fuzzy Hash: BBE012741043858FEB1AEB68FD54B403BA5F751245F044696D0045F33BDBF4552987E1

Uniqueness

Uniqueness Score: -1.00%

Function 00EA0848 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1328883191.0000000000EA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ea0000_592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de31e061d2381b2151f06e1ff2b403cb6e35925347d56bc9d525518c0224ffc8
Instruction ID: a709f90ce26eaaa64b70504c63dd83e7da9fa9795db4b00cfcddcc348dbccc02
Opcode Fuzzy Hash: de31e061d2381b2151f06e1ff2b403cb6e35925347d56bc9d525518c0224ffc8
Instruction Fuzzy Hash: BED0C9345043898BFB6AEB24FC497453B99F750618F008694D0080F33BDFF9692A8BE6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: system.exePID: 7392, Parent PID: 5100COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2%
Total number of Nodes:	149
Total number of Limit Nodes:	7

Executed Functions

Function 030EEF10 Relevance: 9.7, Strings: 7, Instructions: 905COMMON

Download Yara Rule

Strings

(oq, xrefs: 030EF43A
(oq, xrefs: 030EF780
Hq, xrefs: 030EF306
(oq, xrefs: 030EFA9D
(oq, xrefs: 030EF772
,q, xrefs: 030EF7EA
,q, xrefs: 030EF7F8

Memory Dump Source

Source File: 0000000A.00000002.3743623732.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30e0000_system.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$,q$,q$Hq
API String ID: 0-2858405300
Opcode ID: f21aa202f1864a9502a6d13dce1e594e7509a7782bb093173e99b8cb6760031e
Instruction ID: 1e3fc3907afde58f9f1816db7a5b4fa5bdeec89bb509ffe8c8565c448733644a
Opcode Fuzzy Hash: f21aa202f1864a9502a6d13dce1e594e7509a7782bb093173e99b8cb6760031e
Instruction Fuzzy Hash: 94726E71B0121A9FDB54DF69C984AAEBBF6BF88300F198459E805EB3A5DB30DD41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 030E4CE0 Relevance: 1.7, APIs: 1, Instructions: 218
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,?,?,?,00000000,00000000,?), ref: 030EAD31

Memory Dump Source

Source File: 0000000A.00000002.3743623732.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30e0000_system.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3b640375805921e79216ae9c033f61b54343e0963eaebfd80cd373a0c6e4de36
Instruction ID: c62922f4fe4fe3942603db6776edfb5b5ac4897bbb4d0a54157e28cf133847fb
Opcode Fuzzy Hash: 3b640375805921e79216ae9c033f61b54343e0963eaebfd80cd373a0c6e4de36
Instruction Fuzzy Hash: 4F910671E01719DFDB18CFA9C884B9EFBF2AF88300F298529E415AB250D774A945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 030EAB37 Relevance: 1.7, APIs: 1, Instructions: 216
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,?,?,?,00000000,00000000,?), ref: 030EAD31

Memory Dump Source

Source File: 0000000A.00000002.3743623732.00000000030E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 030E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_30e0000_system.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fce326950a2ad7e3a54dd47b5fb52e6126edc57d6106c3c57174381d12c9e2fd
Instruction ID: e17626567e22679bb6b4f0645be48aec631de05e07bb3cf240332ceb9694890c
Opcode Fuzzy Hash: fce326950a2ad7e3a54dd47b5fb52e6126edc57d6106c3c57174381d12c9e2fd
Instruction Fuzzy Hash: C491E571E012199FDB19CFA9C88479EFBF2BF88300F29852AE415AB250D774A945CF51

Uniqueness

Uniqueness Score: -1.00%

Function 057F1BB3 Relevance: 1.7, Strings: 1, Instructions: 414
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 057F1CBC

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: ea844ec8268075d05fa7df0f4e17c70585b5e0eb7447a0ddfa1174baed26af57
Instruction ID: bf0b97dd5945ef72e0181dee5e8959d14a1d74943a84a02a5a3e13acef2b4e07
Opcode Fuzzy Hash: ea844ec8268075d05fa7df0f4e17c70585b5e0eb7447a0ddfa1174baed26af57
Instruction Fuzzy Hash: 0FF15574B00204DFEB58DB7AD458B6E7BB2FB88710F148068E9169B3A4DF399C81CB55

Uniqueness

Uniqueness Score: -1.00%

Function 057F15D0 Relevance: 1.7, Strings: 1, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 057F1AAF

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 15867d0af63bf7c9b6666c72e618f2e1767bc5311c26f582664b82ad9954b23a
Instruction ID: 25f5643b8026c7af70ec4bbbc88a2fcbf3410a5c4b22f4c8aae72c537ded95ba
Opcode Fuzzy Hash: 15867d0af63bf7c9b6666c72e618f2e1767bc5311c26f582664b82ad9954b23a
Instruction Fuzzy Hash: 49F16C35A00204DFDB14DF69C588A6D77F2FF89320F598198E925AB3A1DB35EC41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 057FA9D8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8e673f658d01790c733a3ac09293d7da5314bc4ee3cbe43e13e6af5f2922029d
Instruction ID: 47d418063931ba6f72bfcd268b07b82a0264deb74e140459477af834315ec176
Opcode Fuzzy Hash: 8e673f658d01790c733a3ac09293d7da5314bc4ee3cbe43e13e6af5f2922029d
Instruction Fuzzy Hash: 90814970A00B058FD724DF2AD544B9ABBF2FF88214F04892ED54AD7B50DB35E849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 057FCB31 Relevance: 1.7, APIs: 1, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 057FCCC2

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 09d519f5e0f338dd105daf37733736508e2df2b5eed5510141d6d1d448af4732
Instruction ID: 44260b2b7aec382accdd3a00d1e3380c333a2cd3fcaef0cc7b1139bd4cbb3716
Opcode Fuzzy Hash: 09d519f5e0f338dd105daf37733736508e2df2b5eed5510141d6d1d448af4732
Instruction Fuzzy Hash: B06115B1C0824DAFDF06CFA9C984ADDBFB5BF49304F14816AE908AB261D7719845EF50

Uniqueness

Uniqueness Score: -1.00%

Function 057F9E84 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 057FCCC2

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0788ff4e0b6e50d0875426376bec8ba7eb522e9844f4e7d596be088ab71e6e14
Instruction ID: d4b0460cf7a531a92d8ba1f06327a29406aa4692d3016206fb3f18e2a21ee7d8
Opcode Fuzzy Hash: 0788ff4e0b6e50d0875426376bec8ba7eb522e9844f4e7d596be088ab71e6e14
Instruction Fuzzy Hash: 1151CEB1D0435C9FDB15CF99C884ADEBBB5BF88304F24812AE919AB250D775A841CF94

Uniqueness

Uniqueness Score: -1.00%

Function 057FDAD4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 057FF3B1

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c1e00b92b921979f4af4b0d1e0ba1777a29b2429bf97d38af0b1d65bed132be5
Instruction ID: d98846a2bc702b3b96231857e7644023cf6f7b3257472499a999491264e89be9
Opcode Fuzzy Hash: c1e00b92b921979f4af4b0d1e0ba1777a29b2429bf97d38af0b1d65bed132be5
Instruction Fuzzy Hash: A2413AB5904319DFDB14CF99C448AAEBBF5FF88314F248459E519AB321CB74A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 057F3498 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,057F3466,?,?,?,?,?), ref: 057F3527

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b40a512be2ece23dc294e475c0009ac87b788b8146f3c74645c04a460d0521bb
Instruction ID: 63f504d7659c0c4e24c21bd1967fb1ce9c894679e48f0a7d6f9f2169b54b54db
Opcode Fuzzy Hash: b40a512be2ece23dc294e475c0009ac87b788b8146f3c74645c04a460d0521bb
Instruction Fuzzy Hash: 4321E3B6D00258AFDB10CFAAD984ADEBBF4FB48314F14841AE914A7350C778A944DF65

Uniqueness

Uniqueness Score: -1.00%

Function 057F2A30 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,057F3466,?,?,?,?,?), ref: 057F3527

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9c99b26e8817523c4b00e09be896ea66c4726ef26146994663c73e23ef35a164
Instruction ID: 8209e671aab02cda1ee140ade755f9221d3fdf90055a253d8b3ef64a6732b89e
Opcode Fuzzy Hash: 9c99b26e8817523c4b00e09be896ea66c4726ef26146994663c73e23ef35a164
Instruction Fuzzy Hash: 752103B5D00248EFDB10CFAAD884AEEBBF4FB48310F10841AE914A7310D378A940CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 057F9D10 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,057FACA9,00000800,00000000,00000000), ref: 057FAE9A

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e53557e3ab45316991add4123ba8e609ba52d41507e7041aefdd468b86899310
Instruction ID: 241f554cf63965d2a34e51da13e1aff7fec44cef514ede70e3f2f562bd8e6e29
Opcode Fuzzy Hash: e53557e3ab45316991add4123ba8e609ba52d41507e7041aefdd468b86899310
Instruction Fuzzy Hash: 4711D3B6D043599FDB24CF9AD444BDEFBF5AB88310F10842AE919A7300C375A945CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 057FAE29 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,057FACA9,00000800,00000000,00000000), ref: 057FAE9A

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a4416c395051d25eb16bf4dc04c86b16cc7e2af24abe2ffcc3ebb8e3d924e5ec
Instruction ID: 39cc2d946a9645b199f9c4b437ade5cb890bbd6979d906a0a2b4246d60475a84
Opcode Fuzzy Hash: a4416c395051d25eb16bf4dc04c86b16cc7e2af24abe2ffcc3ebb8e3d924e5ec
Instruction Fuzzy Hash: 6411FFB6C002088FDB20CFAAD545B9EFBF4AB48310F15842AD919A7700C379A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 057F9CC8 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,057FA9F4), ref: 057FAC2E

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: efb1c389c5d2bd7311e6b83872b0145fa2f513aef1651b2764140bc56328c37f
Instruction ID: 877a6e68e12200496413054a4490269e8540be8724cfcd7ad0f23ac8e337338b
Opcode Fuzzy Hash: efb1c389c5d2bd7311e6b83872b0145fa2f513aef1651b2764140bc56328c37f
Instruction Fuzzy Hash: 2911FDB6C043498FCB24CF9AD544A9EFBF5AB88224F14842AD919A7310C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014BD4F4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3733052023.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14bd000_system.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91bc2e6b7a6e1809f0c01e6e7c267c41df6625ce9a87f9ab10f9b1a953553ea3
Instruction ID: f2393d4c4ab8434a6f0a39e9132c40763c811236c4879e38da6830914f0fc4d0
Opcode Fuzzy Hash: 91bc2e6b7a6e1809f0c01e6e7c267c41df6625ce9a87f9ab10f9b1a953553ea3
Instruction Fuzzy Hash: 82210372904204EFDB15DF54D9C0B67BFA5FB8831CF2485AAE9090B266C336D456CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 014CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3733528200.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14cd000_system.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8c329a491d28e723ad2064103b5fbe43102313e1d51981852291e0625f297a3
Instruction ID: 4a76428bb58a5e1162064a29fa8e4726a3bd739b2b4ed412bc298b615610987b
Opcode Fuzzy Hash: c8c329a491d28e723ad2064103b5fbe43102313e1d51981852291e0625f297a3
Instruction Fuzzy Hash: F92106B9904200DFDB55DF58D5C0B16BBA1FB84718F20C57ED90A0B366C336D447CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 014CD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3733528200.00000000014CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14cd000_system.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3569574ed87d6bce883c6dd62b6c71923e0a51b8415608c3a6819d37109aec3b
Instruction ID: f2b2a04a43714be2485e6595e7c04c3686466008eefa1527ed42ab7f0ec3d5f1
Opcode Fuzzy Hash: 3569574ed87d6bce883c6dd62b6c71923e0a51b8415608c3a6819d37109aec3b
Instruction Fuzzy Hash: 782183755093808FCB12CF24D594716BF71EB46214F28C5EFD8498F667C33A980ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 014BD4EF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3733052023.00000000014BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 014BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_14bd000_system.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction ID: 79eda649e5d6cfe35406a13d1ad4fde51bb9bfdc90730ae61032bab7c26f1288
Opcode Fuzzy Hash: b6c069b3d400d01fa3022dda7a4192202465086b1da4fe746ff97b9e65d68317
Instruction Fuzzy Hash: 9211DF72804280CFCB12CF54D5C4B56BF71FB84318F2485AAD8090B666C33AD456CBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 057F9BC0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7303c9f95b03a0db60185e981fbfccd1d8435708ba58d01c9613ef190b33a7ea
Instruction ID: aca263324db628c2b25d55f12c5995f2d8fd4a8ce768dfef8da379a3192946de
Opcode Fuzzy Hash: 7303c9f95b03a0db60185e981fbfccd1d8435708ba58d01c9613ef190b33a7ea
Instruction Fuzzy Hash: 70A15036B102158FCF05DFB4C4889AEB7B2FF85300B15856AEA06AB351DB31E946DB40

Uniqueness

Uniqueness Score: -1.00%

Function 057FB308 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.3752601325.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_57f0000_system.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5fc5559622e22ce7ece29d92328bdb5c3f3808d1696170f368cb5a74ce2a723
Instruction ID: 2a807267564a27d6d5f972e9891f8a3bf1b0934ae68c09966c2f8d9f1a91cf33
Opcode Fuzzy Hash: d5fc5559622e22ce7ece29d92328bdb5c3f3808d1696170f368cb5a74ce2a723
Instruction Fuzzy Hash: 3FC1F8F4420749AAE750CFA5E84A1A93FB3FB45334B14630AEA612B2D4DFB8144BDF54

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe.log

C:\Users\user\AppData\Local\Temp\system.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
592CDAD0A5B0AE90E0C812AECB2677096AF06CF941CE2.exe

Function 030E4CE0 Relevance: 1.7, APIs: 1, Instructions: 218
processCOMMON

Function 030EAB37 Relevance: 1.7, APIs: 1, Instructions: 216
processCOMMON

Function 057F1BB3 Relevance: 1.7, Strings: 1, Instructions: 414
COMMON

Function 057F15D0 Relevance: 1.7, Strings: 1, Instructions: 411
COMMON

Function 057FA9D8 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 057FCB31 Relevance: 1.7, APIs: 1, Instructions: 184
COMMON

Function 057F9E84 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 057FDAD4 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON