Windows Analysis Report
W9UAjNR4L6.exe

AI detected suspicious sample

Source: Yara match	File source: W9UAjNR4L6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4124195324.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W9UAjNR4L6.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Umbrella.flv.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: W9UAjNR4L6.exe

Joe Sandbox ML: detected

Source: W9UAjNR4L6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Contains functionality to spread to USB devices (.Net source)

Source: W9UAjNR4L6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Source: W9UAjNR4L6.exe, -.cs	.Net Code: @
Source: Umbrella.flv.exe.0.dr, -.cs	.Net Code: @

Creates autorun.inf (USB autostart)

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

File created: C:\autorun.inf

Suricata IDS alerts for network traffic

Source: W9UAjNR4L6.exe, 00000000.00000002.4124195324.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \autorun.inf
Source: W9UAjNR4L6.exe, 00000000.00000002.4124195324.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: W9UAjNR4L6.exe, 00000000.00000002.4124195324.0000000002B51000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf$OEk
Source: W9UAjNR4L6.exe, 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \autorun.inf
Source: W9UAjNR4L6.exe, 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: W9UAjNR4L6.exe, 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: W9UAjNR4L6.exe	Binary or memory string: \autorun.inf
Source: W9UAjNR4L6.exe	Binary or memory string: [autorun]
Source: W9UAjNR4L6.exe	Binary or memory string: autorun.inf
Source: Umbrella.flv.exe.0.dr	Binary or memory string: \autorun.inf
Source: Umbrella.flv.exe.0.dr	Binary or memory string: [autorun]
Source: Umbrella.flv.exe.0.dr	Binary or memory string: autorun.inf
Source: autorun.inf.0.dr	Binary or memory string: [autorun]

Networking

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49731 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49731 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49733 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49733 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49742 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49742 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49750 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49753 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49746 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49742 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49746 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49753 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49745 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49776 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49732 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49776 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49740 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49746 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49745 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49765 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49750 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49732 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49765 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49736 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49744 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49759 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49740 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49782 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49748 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49759 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49748 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49749 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49749 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49744 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49759 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49744 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49782 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49736 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49747 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49747 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49788 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49765 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49798 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49743 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49824 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49730 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49818 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49818 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49788 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49831 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49845 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49824 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49845 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49804 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49798 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49831 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49730 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49858 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49858 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49804 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49837 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49837 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49851 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49851 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49878 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49878 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49743 -> 3.126.37.18:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49887 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49887 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49891 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49891 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49871 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49922 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49922 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49871 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49939 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49939 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49944 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49947 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49947 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49898 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49898 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49953 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49944 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49933 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49933 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49953 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49944 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49959 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49959 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49811 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49965 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49965 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49916 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49916 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49965 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49909 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49972 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49972 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49865 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49909 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49865 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49882 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49981 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49882 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49981 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49978 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49978 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49993 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49993 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49903 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49903 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49927 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49927 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50007 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50018 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50018 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50007 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50024 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50024 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49811 -> 18.156.13.209:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50002 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50002 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50012 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50012 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50048 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50048 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49999 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49999 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50032 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50042 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50042 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50027 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50052 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50057 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50038 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50038 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50038 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50012 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50052 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50032 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50083 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50083 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50087 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50087 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50057 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50095 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50095 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50101 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50101 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50063 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50076 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49999 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50052 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50080 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50032 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50080 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50094 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50079 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50027 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50078 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50063 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50078 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50076 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50073 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50073 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50091 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50085 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50067 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50091 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50097 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50067 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50099 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50092 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50092 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50027 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50081 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50085 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50081 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50094 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50086 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50086 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50100 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50079 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50099 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50088 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50084 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50098 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50084 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50098 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50097 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50090 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50077 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50100 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50088 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50102 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50090 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50077 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50096 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50102 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50096 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50082 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50082 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50082 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50093 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50093 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:50093 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49968 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49968 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49987 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49987 -> 18.192.93.86:12824
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:50089 -> 18.197.239.5:12824
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:50089 -> 18.197.239.5:12824

Source: global traffic	TCP traffic: 192.168.2.4:49730 -> 3.126.37.18:12824
Source: global traffic	TCP traffic: 192.168.2.4:49765 -> 18.156.13.209:12824
Source: global traffic	TCP traffic: 192.168.2.4:49916 -> 18.192.93.86:12824
Source: global traffic	TCP traffic: 192.168.2.4:50057 -> 18.197.239.5:12824

Source: Joe Sandbox View	IP Address: 3.126.37.18 3.126.37.18
Source: Joe Sandbox View	IP Address: 18.156.13.209 18.156.13.209
Source: Joe Sandbox View	IP Address: 18.192.93.86 18.192.93.86

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 2.tcp.eu.ngrok.io

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Window created: window name: CLIPBRDWNDCLASS

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: W9UAjNR4L6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4124195324.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W9UAjNR4L6.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED

System Summary

Source: W9UAjNR4L6.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: W9UAjNR4L6.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: W9UAjNR4L6.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: W9UAjNR4L6.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_00C02BCF	0_2_00C02BCF
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_00C0247C	0_2_00C0247C
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_00C025FE	0_2_00C025FE
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_00C1C0B0	0_2_00C1C0B0
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D04298	0_2_04D04298
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D047D4	0_2_04D047D4
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D044F1	0_2_04D044F1
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D049F9	0_2_04D049F9
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D0499D	0_2_04D0499D
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D04B5B	0_2_04D04B5B
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D04544	0_2_04D04544
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D0470F	0_2_04D0470F
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D04630	0_2_04D04630
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D04936	0_2_04D04936
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D050E3	0_2_04D050E3
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D04F9D	0_2_04D04F9D
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D04C8F	0_2_04D04C8F
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D05459	0_2_04D05459
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D0505D	0_2_04D0505D
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D0536F	0_2_04D0536F
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D05000	0_2_04D05000
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_04D04F2F	0_2_04D04F2F

Source: W9UAjNR4L6.exe, 00000000.00000002.4123378997.0000000000ABE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs W9UAjNR4L6.exe

Source: W9UAjNR4L6.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: W9UAjNR4L6.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: W9UAjNR4L6.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: W9UAjNR4L6.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: W9UAjNR4L6.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Umbrella.flv.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.spre.phis.troj.evad.winEXE@10/7@4/4

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_054C26AE AdjustTokenPrivileges,		0_2_054C26AE
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Code function: 0_2_054C2677 AdjustTokenPrivileges,		0_2_054C2677

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

File created: C:\Users\user\AppData\Roaming\app

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Mutant created: \Sessions\1\BaseNamedObjects\479c12dc394ac2d8130b559c835e22f3
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6200:120:WilError_03
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8:120:WilError_03

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

File created: C:\Users\user\AppData\Local\Temp\FransescoPast.txt

Source: W9UAjNR4L6.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: W9UAjNR4L6.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: W9UAjNR4L6.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

File read: C:\Users\user\Desktop\W9UAjNR4L6.exe

Source: unknown	Process created: C:\Users\user\Desktop\W9UAjNR4L6.exe "C:\Users\user\Desktop\W9UAjNR4L6.exe"
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe" "W9UAjNR4L6.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe"
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe" "W9UAjNR4L6.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe" "W9UAjNR4L6.exe" ENABLE	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall delete allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe"	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe" "W9UAjNR4L6.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: W9UAjNR4L6.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

.NET source code contains potential unpacker

Source: W9UAjNR4L6.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: W9UAjNR4L6.exe, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])
Source: Umbrella.flv.exe.0.dr, -.cs	.Net Code: @ System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

File created: C:\Umbrella.flv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Memory allocated: DD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Memory allocated: 2B50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Memory allocated: 4B50000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Window / User API: threadDelayed 683	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Window / User API: threadDelayed 3409	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Window / User API: threadDelayed 5178	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Window / User API: foregroundWindowGot 782	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe	Window / User API: foregroundWindowGot 771	Jump to behavior

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe TID: 4588	Thread sleep count: 683 > 30	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe TID: 4588	Thread sleep time: -68300s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe TID: 6108	Thread sleep count: 3409 > 30	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe TID: 6108	Thread sleep time: -3409000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe TID: 6108	Thread sleep count: 5178 > 30	Jump to behavior
Source: C:\Users\user\Desktop\W9UAjNR4L6.exe TID: 6108	Thread sleep time: -5178000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: netsh.exe, 00000001.00000002.1691165565.0000000000EDA000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000004.00000003.1700323426.0000000000512000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: W9UAjNR4L6.exe, 00000000.00000002.4123378997.0000000000B4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdd name="AspNe
Source: netsh.exe, 00000003.00000002.1698510909.000000000078A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllb
Source: W9UAjNR4L6.exe, 00000000.00000002.4123378997.0000000000B4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Memory allocated: page read and write | page guard

Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:36:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:31:38 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 07:38:55 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 20:37:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 20:54:49 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:13:36 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:02:10 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/11 \| 12:46:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:00:55 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 08:56:18 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:08:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 08:25:35 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/28 \| 08:22:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:05:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 11:29:07 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 13:01:36 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:08:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:39:30 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:14:19 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 12:52:12 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:44:19 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:57:43 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 21:20:05 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/11 \| 13:33:38 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:30:26 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:15:30 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:57:25 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:15:49 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:01:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:00:16 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:28:41 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:38:00 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:50:53 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 08:51:01 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:23:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:30:08 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:32:13 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:04:50 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:18:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:35:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:22:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:01:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/28 \| 03:26:41 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 23:37:45 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:43:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:14:00 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 22:30:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124195324.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:28:02 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:02:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 00:53:19 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:11:05 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:29:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:18:43 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/25 \| 11:38:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:28:16 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:54:17 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 20:41:02 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:44:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:44:05 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:43:02 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:46:13 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:34:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:05:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:17:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:50:30 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:00:16 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:19:07 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:19:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:09:48 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 12:41:52 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 21:28:13 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 21:05:05 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:55:18 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 11:46:44 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:45:59 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:01:17 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:32:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:57:02 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 09:44:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:24:35 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:22:31 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:55:47 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 22:13:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 08:51:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 12:41:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:50:01 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:19:26 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:27:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 16:58:30 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:21:21 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:17:52 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:21:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:11:44 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:35:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:37:59 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:03:59 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:40:42 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:25:55 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:42:45 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:03:40 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 13:30:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:27:48 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:52:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:18:43 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:24:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:29:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:19:44 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:56:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:40:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/11 \| 12:50:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:38:50 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 17:28:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:08:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:42:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:35:00 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/28 \| 08:21:16 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:25:41 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 23:17:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:48:53 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 22:54:53 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 08:50:47 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 01:07:12 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:05:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:55:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:45:10 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/28 \| 08:09:53 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:34:23 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:02:00 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:13:55 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 21:32:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 12:18:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:56:38 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:15:10 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 13:16:56 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 13:27:45 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:56:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:25:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:36:44 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 22:22:40 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 07:51:48 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 21:26:13 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:18:45 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:33:22 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:28:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 23:06:25 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:19:49 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:51:21 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 22:47:06 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:12:25 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:34:21 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:16:22 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 15:05:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:19:30 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:04:21 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 18:09:59 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:18:06 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 23:40:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 00:56:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:08:47 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:28:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:06:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:52:23 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:38:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:00:18 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 16:53:12 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:54:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:36:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:51:50 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:52:47 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:23:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 17:09:50 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:07:17 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 21:20:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:16:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:51:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:39:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 11:59:13 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 12:50:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:06:44 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:47:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 00:43:21 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 00:19:02 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 07:30:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:46:17 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:06:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:14:48 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/25 \| 19:28:42 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/05 \| 00:16:19 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:17:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:22:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:12:35 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:40:22 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:57:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:39:38 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:30:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 18:08:29 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:39:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:21:01 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:03:20 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:19:17 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:28:35 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:59:05 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:49:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:58:15 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:31:00 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:04:56 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 20:57:45 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:47:23 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:53:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 12:30:26 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:01:19 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 15:48:02 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:29:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/05 \| 00:30:40 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 13:11:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:45:35 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:14:15 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:40:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:58:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 17:19:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:08:08 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 09:22:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 17:16:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 08:16:30 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:26:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:09:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:02:47 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:12:06 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:10:08 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:19:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/05 \| 00:51:27 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 03:58:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:16:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 23:49:27 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:56:48 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 18:51:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:43:42 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 22:10:15 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:32:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:00:49 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:45:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:10:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 13:44:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:19:29 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:08:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:10:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/28 \| 08:32:42 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:45:20 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 18:25:29 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 07:47:21 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 16:52:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 21:16:31 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:51:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 17:15:56 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:53:01 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:32:23 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 13:07:15 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:31:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 21:37:18 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 17:51:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:08:18 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:01:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:02:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/11 \| 13:28:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/09 \| 09:26:12 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:23:05 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/05 \| 00:04:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:13:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:15:29 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:24:38 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:11:25 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 12:30:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 07:29:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:59:52 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:02:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 05:20:06 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:46:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 15:26:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:18:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 08:51:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 16:03:45 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:25:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 08:27:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:39:48 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/09 \| 09:17:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:11:13 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:55:55 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:55:02 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:11:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:06:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:15:45 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:03:49 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:10:42 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 13:22:08 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 23:56:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:20:40 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 18:02:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:05:10 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:30:22 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 23:36:52 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:47:26 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:59:48 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:33:35 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:26:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:46:05 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 08:48:06 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 12:37:27 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:41:25 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 23:17:23 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 12:16:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:14:29 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 09:12:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 11:42:20 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:43:38 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:26:55 - Program Manager
Source: W9UAjNR4L6.exe, Umbrella.flv.exe.0.dr	Binary or memory string: Shell_traywnd+MostrarBarraDeTarefas
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:30:36 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 13:01:43 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:22:41 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/29 \| 17:04:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 07:57:56 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:28:59 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:30:45 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/02 \| 17:10:55 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:52:17 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 18:29:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:22:02 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:03:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:46:30 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.0000000002BC6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 09:15:59 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:38:01 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 16:45:17 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:11:07 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 21:02:53 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:43:26 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:42:12 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 10:22:36 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/11 \| 13:13:07 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 12:18:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 22:40:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:16:52 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:56:50 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:52:00 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:07:25 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:49:20 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 09:10:42 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:31:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:43:12 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:20:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:00:56 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 07:50:18 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 22:44:29 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 04:39:38 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:34:56 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/11 \| 13:06:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 03:13:03 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 11:38:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:49:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 13:10:49 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/31 \| 20:38:07 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 04:21:07 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:35:41 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:22:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/02 \| 17:03:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:05:27 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:13:26 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:44:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:46:50 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 08:18:53 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:19:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:10:12 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 10:54:27 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:58:02 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:48:29 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:05:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:05:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:00:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:27:05 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 02:10:56 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:18:26 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:12:16 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 13:15:49 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 10:56:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 07:35:52 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 15:47:31 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 23:27:41 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:10:52 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/05 \| 08:43:55 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 20:45:07 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:47:06 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:54:31 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:44:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 22:45:20 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 13:13:40 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:31:07 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:13:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:53:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:19:01 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:00:10 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:53:22 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 22:42:28 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 23:31:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 13:34:27 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:21:31 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:05:43 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 13:08:44 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:00:26 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:38:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:27:56 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:57:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:56:01 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:22:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:35:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:04:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 22:53:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:50:50 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 09:06:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:12:08 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:42:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:29:42 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:32:47 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 12:47:30 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 13:03:20 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 17:17:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 09:39:47 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:18:14 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:51:09 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:21:01 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:26:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/11 \| 12:59:31 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:38:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:44:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:14:36 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/28 \| 07:10:35 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:44:29 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:58:52 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:28:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:17:15 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:11:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:15:08 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:11:45 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:03:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 07:25:19 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:33:30 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 23:41:27 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:18:53 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/28 \| 07:55:21 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:41:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 22:28:59 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:31:23 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 18:32:31 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 09:17:52 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:47:36 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 17:50:10 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:09:21 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:15:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:04:19 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 23:02:55 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:20:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:22:34 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 22:07:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 12:48:16 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:07:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:30:38 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/30 \| 12:53:12 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:06:00 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 09:28:58 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:09:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 23:59:54 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 15:29:01 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:20:18 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/05 \| 00:24:51 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:07:11 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:18:46 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 18:17:13 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 17:09:13 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:10:05 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 23:35:44 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 04:54:47 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 22:37:53 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 05:52:53 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:31:56 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 06:06:26 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:02:20 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 00:30:12 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/04 \| 20:51:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/24 \| 23:20:04 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/13 \| 17:38:49 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 01:10:24 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 03:58:40 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/20 \| 09:08:27 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 01:11:57 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:12:33 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp, W9UAjNR4L6.exe, 00000000.00000002.4124195324.00000000030B5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/11/28 \| 08:16:35 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/07 \| 05:27:48 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/22 \| 17:11:32 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/09 \| 17:37:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/15 \| 23:57:39 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 00:07:37 - Program Manager
Source: W9UAjNR4L6.exe, 00000000.00000002.4124950688.0000000003CD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 09:09:31 - Program Manager

Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Contains functionality to disable the Task Manager (.Net Source)

Lowering of HIPS / PFW / Operating System Security Settings

Source: W9UAjNR4L6.exe, -.cs	.Net Code: @
Source: Umbrella.flv.exe.0.dr, -.cs	.Net Code: @

Disables zone checking for all users

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Modifies the windows firewall

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe" "W9UAjNR4L6.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\W9UAjNR4L6.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe" "W9UAjNR4L6.exe" ENABLE

Stealing of Sensitive Information

Source: Yara match	File source: W9UAjNR4L6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4124195324.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W9UAjNR4L6.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED

Remote Access Functionality

Source: Yara match	File source: W9UAjNR4L6.exe, type: SAMPLE
Source: Yara match	File source: 0.0.W9UAjNR4L6.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4124195324.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: W9UAjNR4L6.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: C:\Umbrella.flv.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	21 Replication Through Removable Media	Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	41 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
W9UAjNR4L6.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
W9UAjNR4L6.exe	100%	Avira	TR/Dropper.Gen
W9UAjNR4L6.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Umbrella.flv.exe	100%	Avira	TR/Dropper.Gen
C:\Umbrella.flv.exe	100%	Joe Sandbox ML
C:\Umbrella.flv.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT

Name	IP	Active	Malicious	Antivirus Detection	Reputation
2.tcp.eu.ngrok.io	3.126.37.18	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.126.37.18	2.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
18.156.13.209	unknown	United States	16509	AMAZON-02US	true
18.192.93.86	unknown	United States	16509	AMAZON-02US	true
18.197.239.5	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562541
Start date and time:	2024-11-25 17:36:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	W9UAjNR4L6.exe renamed because original name is a hash value
Original Sample Name:	25a598f19fc93ed7abd222c542270070.exe
Detection:	MAL
Classification:	mal100.spre.phis.troj.evad.winEXE@10/7@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 151 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: W9UAjNR4L6.exe

Simulations

Behavior and APIs

Time	Type	Description
11:37:33	API Interceptor	638797x Sleep call for process: W9UAjNR4L6.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.126.37.18	7zFM.exe	Get hash	malicious	ZTrat	Browse
	4xKDL5YCfQ.exe	Get hash	malicious	Njrat	Browse
	b8UsrDOVGV.exe	Get hash	malicious	Njrat	Browse
	tiodtk2cfy.exe	Get hash	malicious	Njrat	Browse
	pQBmVoyRnw.exe	Get hash	malicious	Njrat	Browse
	NezbdhNgwG.exe	Get hash	malicious	Njrat	Browse
	xdPdkPMD8u.exe	Get hash	malicious	Njrat	Browse
	VBUXm77rfL.exe	Get hash	malicious	Njrat	Browse
	gEuhLHV0.posh.ps1	Get hash	malicious	Metasploit	Browse
	MibKbjH4.posh.ps1	Get hash	malicious	Unknown	Browse
18.156.13.209	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/
18.192.93.86	P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/
18.192.93.86	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.tcp.eu.ngrok.io	ULNZPn6D33.exe	Get hash	malicious	Sliver	Browse	18.197.239.5
	Injector.exe	Get hash	malicious	ZTrat	Browse	18.197.239.5
	7zFM.exe	Get hash	malicious	ZTrat	Browse	3.126.37.18
	Game Laucher.exe	Get hash	malicious	Njrat	Browse	18.192.93.86
	10.exe	Get hash	malicious	Unknown	Browse	18.192.93.86
	En3e396wX1.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	ZxocxU01PB.exe	Get hash	malicious	Njrat	Browse	18.197.239.5
	4xKDL5YCfQ.exe	Get hash	malicious	Njrat	Browse	18.156.13.209
	R3ov8eFFFP.exe	Get hash	malicious	Njrat	Browse	3.127.138.57
	Ve0c8i5So2.exe	Get hash	malicious	Njrat	Browse	18.157.68.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	AccountDocuments - christinal.docx	Get hash	malicious	Unknown	Browse	13.227.8.48
	https://protection.cloze.email/r/EKJc7NAc1aGPd0140vt6MnJzYkpI4pQCyldpUEBtdFT8T8dhNmmHodcXxvKddJW4AhfqaDIQj32BX0HxSGbmPeDqDQs/n/SlBNQ05FV1NMRVRURVI/y52l9ppb.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fcloudprotectionc5f91e84a2b3d9e748f2a1d9b7e5f0c4a2b3d9e7a5pages.dynamixs.workers.dev%2F/1/010601933048cf65-492c630f-d6b3-471e-a31f-bf186231f1e8-000000/SL9CcqykWh2mQIC7eGiOMwzMSpk=185	Get hash	malicious	Unknown	Browse	35.79.77.164
	https://eastmancuts.jimdosite.com/	Get hash	malicious	Unknown	Browse	54.171.97.194
	https://www.google.com/url?q=https://clickme.thryv.com/ls/click?upn%3Du001.3HlspJ5fg-2BP4CQkV7GSVhvWTpgC6w0k7sA8b2Z9JBYU9BEMXtqHWLHW9PPcpforJszQ3_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQiOVUz527Ewi1t813S-2FHejAJLe09fD2VqgM8mtwuQZA9i83VLkCPF4iItCSPXKUpNgWQKWxjEO6jlBp5GYVLghrpKcDuea5GONmLMVlbh4fQe7dtjhTFxxxExxfN1kv5tnx1PPl9DjYIyE468wz1qa1Z-2FWJgZrJbIFEpqhd4o5tGGyUoiPcIot5l2j9dpjy7QKj99ZiCz-2BBLi5dHUIl8gC4RxZBl-2FMaH4IZlQyWpqM-2BtZ9uE3ezFUl2fORMwAp4lQk-3D%23Cjanetrosenbach@imageindustries.com&source=gmail-imap&ust=1733149343000000&usg=AOvVaw1uIAp-JnZbTlkY9Td9ZLJj	Get hash	malicious	HTMLPhisher	Browse	3.160.188.6
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	3.160.188.18
	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse	18.158.211.73
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	3.120.233.20
	https://docs.zoom.us/doc/5mbYcD6lRBK5O3HcDEXhFA?from=email	Get hash	malicious	Unknown	Browse	52.84.151.54
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	15.188.89.37
	http://begantotireo.xyz	Get hash	malicious	Unknown	Browse	76.223.26.96
AMAZON-02US	AccountDocuments - christinal.docx	Get hash	malicious	Unknown	Browse	13.227.8.48
	https://protection.cloze.email/r/EKJc7NAc1aGPd0140vt6MnJzYkpI4pQCyldpUEBtdFT8T8dhNmmHodcXxvKddJW4AhfqaDIQj32BX0HxSGbmPeDqDQs/n/SlBNQ05FV1NMRVRURVI/y52l9ppb.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fcloudprotectionc5f91e84a2b3d9e748f2a1d9b7e5f0c4a2b3d9e7a5pages.dynamixs.workers.dev%2F/1/010601933048cf65-492c630f-d6b3-471e-a31f-bf186231f1e8-000000/SL9CcqykWh2mQIC7eGiOMwzMSpk=185	Get hash	malicious	Unknown	Browse	35.79.77.164
	https://eastmancuts.jimdosite.com/	Get hash	malicious	Unknown	Browse	54.171.97.194
	https://www.google.com/url?q=https://clickme.thryv.com/ls/click?upn%3Du001.3HlspJ5fg-2BP4CQkV7GSVhvWTpgC6w0k7sA8b2Z9JBYU9BEMXtqHWLHW9PPcpforJszQ3_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQiOVUz527Ewi1t813S-2FHejAJLe09fD2VqgM8mtwuQZA9i83VLkCPF4iItCSPXKUpNgWQKWxjEO6jlBp5GYVLghrpKcDuea5GONmLMVlbh4fQe7dtjhTFxxxExxfN1kv5tnx1PPl9DjYIyE468wz1qa1Z-2FWJgZrJbIFEpqhd4o5tGGyUoiPcIot5l2j9dpjy7QKj99ZiCz-2BBLi5dHUIl8gC4RxZBl-2FMaH4IZlQyWpqM-2BtZ9uE3ezFUl2fORMwAp4lQk-3D%23Cjanetrosenbach@imageindustries.com&source=gmail-imap&ust=1733149343000000&usg=AOvVaw1uIAp-JnZbTlkY9Td9ZLJj	Get hash	malicious	HTMLPhisher	Browse	3.160.188.6
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	3.160.188.18
	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse	18.158.211.73
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	3.120.233.20
	https://docs.zoom.us/doc/5mbYcD6lRBK5O3HcDEXhFA?from=email	Get hash	malicious	Unknown	Browse	52.84.151.54
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	15.188.89.37
	http://begantotireo.xyz	Get hash	malicious	Unknown	Browse	76.223.26.96
AMAZON-02US	AccountDocuments - christinal.docx	Get hash	malicious	Unknown	Browse	13.227.8.48
	https://protection.cloze.email/r/EKJc7NAc1aGPd0140vt6MnJzYkpI4pQCyldpUEBtdFT8T8dhNmmHodcXxvKddJW4AhfqaDIQj32BX0HxSGbmPeDqDQs/n/SlBNQ05FV1NMRVRURVI/y52l9ppb.r.ap-northeast-1.awstrack.me/L0/https:%2F%2Fcloudprotectionc5f91e84a2b3d9e748f2a1d9b7e5f0c4a2b3d9e7a5pages.dynamixs.workers.dev%2F/1/010601933048cf65-492c630f-d6b3-471e-a31f-bf186231f1e8-000000/SL9CcqykWh2mQIC7eGiOMwzMSpk=185	Get hash	malicious	Unknown	Browse	35.79.77.164
	https://eastmancuts.jimdosite.com/	Get hash	malicious	Unknown	Browse	54.171.97.194
	https://www.google.com/url?q=https://clickme.thryv.com/ls/click?upn%3Du001.3HlspJ5fg-2BP4CQkV7GSVhvWTpgC6w0k7sA8b2Z9JBYU9BEMXtqHWLHW9PPcpforJszQ3_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQiOVUz527Ewi1t813S-2FHejAJLe09fD2VqgM8mtwuQZA9i83VLkCPF4iItCSPXKUpNgWQKWxjEO6jlBp5GYVLghrpKcDuea5GONmLMVlbh4fQe7dtjhTFxxxExxfN1kv5tnx1PPl9DjYIyE468wz1qa1Z-2FWJgZrJbIFEpqhd4o5tGGyUoiPcIot5l2j9dpjy7QKj99ZiCz-2BBLi5dHUIl8gC4RxZBl-2FMaH4IZlQyWpqM-2BtZ9uE3ezFUl2fORMwAp4lQk-3D%23Cjanetrosenbach@imageindustries.com&source=gmail-imap&ust=1733149343000000&usg=AOvVaw1uIAp-JnZbTlkY9Td9ZLJj	Get hash	malicious	HTMLPhisher	Browse	3.160.188.6
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	3.160.188.18
	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse	18.158.211.73
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	3.120.233.20
	https://docs.zoom.us/doc/5mbYcD6lRBK5O3HcDEXhFA?from=email	Get hash	malicious	Unknown	Browse	52.84.151.54
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	15.188.89.37
	http://begantotireo.xyz	Get hash	malicious	Unknown	Browse	76.223.26.96

Process:	C:\Users\user\Desktop\W9UAjNR4L6.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	5.551118199874692
Encrypted:	false
SSDEEP:	768:EGZel/M+0uGAfIi+qXuzMywjZdLJakHX+xWvYR4SYzktFI3tr3/iTnRVOR1MY4ZW:Ol/l0pUjBjZdL4kHG5mktQJVR1Ap8v
MD5:	25A598F19FC93ED7ABD222C542270070
SHA1:	81E6B383F7200927D12EC89EA471AC72657D2E6A
SHA-256:	791DDABC0FE9675F1DE59E055FFD6A292BE34144D9F02803311EB9FB3DCC44EA
SHA-512:	B58FACCEFFFDBE44F5725080C0442E827A7AAE7FCCA5763C065D4163D0AA78744643701D1F28EC0412957945297DD11C08A46E42B30D190DF2ADBF58BA70661F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Umbrella.flv.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Umbrella.flv.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Umbrella.flv.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Umbrella.flv.exe, Author: JPCERT/CC Incident Response Group Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Umbrella.flv.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ag.................h..........^.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...df... ...h.................. ..`.reloc...............j..............@..B........................................................@.......H.......................................................................&.(......*..(.......s.........s.........s.........s...........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.............(....(.....+.....0............(.....+...0................(.....+...0............(.....+...0.. ...................,.(...+.+.+....+....0...........................*..(..........0..&........~..............,.(...+.

C:\Umbrella.flv.exe:Zone.Identifier

Process:	C:\Users\user\Desktop\W9UAjNR4L6.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\app

Process:	C:\Users\user\Desktop\W9UAjNR4L6.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:j:j
MD5:	CAC4598FDC0F92181616D12833EB6CA1
SHA1:	80A7B7A46A0E8E674B782B9EB569E5430A69C84B
SHA-256:	275918973C23AD700F278C69CC03C9C82EC9F4D9ED0F53111AD22BEC197FF440
SHA-512:	01A7556BFCCE6D9D8251AADC7F6E6169FDD0477D487CE88729C44BFE8B85B2EEE500985D553C0479765EF5B5C6DC3517C0305EFB9089814C3F8A9EA6FC51C713
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.25

C:\autorun.inf

Process:	C:\Users\user\Desktop\W9UAjNR4L6.exe
File Type:	Microsoft Windows Autorun file
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.474554204780528
Encrypted:	false
SSDEEP:	3:It1KV2PHQCyK0x:e1KAwCyD
MD5:	40B1630BE21F39CB17BD1963CAE5A207
SHA1:	63C14BD151D42820DD45C033363FA5B9E1D34124
SHA-256:	F87E55F1A423B65FD639146F71F6027DBD4D6E69B65D9A17F1744774AA6589E1
SHA-512:	833112ED4A9A3C621D2FFFC78F83502B2937B82A2CF9BC692D75D907CE2AA46C2D97CFE23C402DB3292B2DD2655FF8692C3CD00D5BA4D792C3D8AF24958E1926
Malicious:	true
Preview:	[autorun]..open=C:\Umbrella.flv.exe..shellexecute=C:\..

\Device\ConDrv

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.551118199874692
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	W9UAjNR4L6.exe
File size:	93'184 bytes
MD5:	25a598f19fc93ed7abd222c542270070
SHA1:	81e6b383f7200927d12ec89ea471ac72657d2e6a
SHA256:	791ddabc0fe9675f1de59e055ffd6a292be34144d9f02803311eb9fb3dcc44ea
SHA512:	b58faccefffdbe44f5725080c0442e827a7aae7fcca5763c065d4163d0aa78744643701d1f28ec0412957945297dd11c08a46e42b30d190df2adbf58ba70661f
SSDEEP:	768:EGZel/M+0uGAfIi+qXuzMywjZdLJakHX+xWvYR4SYzktFI3tr3/iTnRVOR1MY4ZW:Ol/l0pUjBjZdL4kHG5mktQJVR1Ap8v
TLSH:	C093E74D37E550A5E2FE4AF3A870B2400FB9F0471742938D49E1A9761A33AD84F94DBB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Ag.................h..........^.... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41865e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6741C4DC [Sat Nov 23 12:04:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1860c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x16664	0x16800	9ae6749b428cd274e5936d5baee28938	False	0.36336805555555557	data	5.583774361201999	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x1a000	0xc	0x200	ff06ea9c63404a08dec111ab855065d8	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T17:37:05.645458+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49730	3.126.37.18	12824	TCP
2024-11-25T17:37:05.645458+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49730	3.126.37.18	12824	TCP
2024-11-25T17:37:09.173294+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49731	3.126.37.18	12824	TCP
2024-11-25T17:37:09.173294+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49731	3.126.37.18	12824	TCP
2024-11-25T17:37:12.983923+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49732	3.126.37.18	12824	TCP
2024-11-25T17:37:12.983923+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49732	3.126.37.18	12824	TCP
2024-11-25T17:37:16.481312+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49733	3.126.37.18	12824	TCP
2024-11-25T17:37:16.481312+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49733	3.126.37.18	12824	TCP
2024-11-25T17:37:20.055878+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49736	3.126.37.18	12824	TCP
2024-11-25T17:37:20.055878+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49736	3.126.37.18	12824	TCP
2024-11-25T17:37:23.718786+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49740	3.126.37.18	12824	TCP
2024-11-25T17:37:23.718786+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49740	3.126.37.18	12824	TCP
2024-11-25T17:37:27.227897+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49742	3.126.37.18	12824	TCP
2024-11-25T17:37:27.227897+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49742	3.126.37.18	12824	TCP
2024-11-25T17:37:27.488424+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49742	3.126.37.18	12824	TCP
2024-11-25T17:37:30.993211+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49743	3.126.37.18	12824	TCP
2024-11-25T17:37:30.993211+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49743	3.126.37.18	12824	TCP
2024-11-25T17:37:34.511539+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49744	3.126.37.18	12824	TCP
2024-11-25T17:37:34.511539+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49744	3.126.37.18	12824	TCP
2024-11-25T17:37:35.611147+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49744	3.126.37.18	12824	TCP
2024-11-25T17:37:37.946487+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49745	3.126.37.18	12824	TCP
2024-11-25T17:37:37.946487+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49745	3.126.37.18	12824	TCP
2024-11-25T17:37:41.712320+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49746	3.126.37.18	12824	TCP
2024-11-25T17:37:41.712320+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49746	3.126.37.18	12824	TCP
2024-11-25T17:37:42.574745+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49746	3.126.37.18	12824	TCP
2024-11-25T17:37:45.405759+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49747	3.126.37.18	12824	TCP
2024-11-25T17:37:45.405759+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49747	3.126.37.18	12824	TCP
2024-11-25T17:37:49.026428+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49748	3.126.37.18	12824	TCP
2024-11-25T17:37:49.026428+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49748	3.126.37.18	12824	TCP
2024-11-25T17:37:52.618515+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49749	3.126.37.18	12824	TCP
2024-11-25T17:37:52.618515+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49749	3.126.37.18	12824	TCP
2024-11-25T17:37:56.196588+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49750	3.126.37.18	12824	TCP
2024-11-25T17:37:56.196588+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49750	3.126.37.18	12824	TCP
2024-11-25T17:38:00.056353+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49753	3.126.37.18	12824	TCP
2024-11-25T17:38:00.056353+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49753	3.126.37.18	12824	TCP
2024-11-25T17:38:03.557267+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49759	3.126.37.18	12824	TCP
2024-11-25T17:38:03.557267+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49759	3.126.37.18	12824	TCP
2024-11-25T17:38:04.427567+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49759	3.126.37.18	12824	TCP
2024-11-25T17:38:07.186505+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49765	18.156.13.209	12824	TCP
2024-11-25T17:38:07.186505+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49765	18.156.13.209	12824	TCP
2024-11-25T17:38:07.431361+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49765	18.156.13.209	12824	TCP
2024-11-25T17:38:10.614625+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49776	18.156.13.209	12824	TCP
2024-11-25T17:38:10.614625+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49776	18.156.13.209	12824	TCP
2024-11-25T17:38:13.808395+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49782	18.156.13.209	12824	TCP
2024-11-25T17:38:13.808395+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49782	18.156.13.209	12824	TCP
2024-11-25T17:38:17.020519+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49788	18.156.13.209	12824	TCP
2024-11-25T17:38:17.020519+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49788	18.156.13.209	12824	TCP
2024-11-25T17:38:20.189801+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49798	18.156.13.209	12824	TCP
2024-11-25T17:38:20.189801+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49798	18.156.13.209	12824	TCP
2024-11-25T17:38:23.045830+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49804	18.156.13.209	12824	TCP
2024-11-25T17:38:23.045830+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49804	18.156.13.209	12824	TCP
2024-11-25T17:38:25.777115+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49811	18.156.13.209	12824	TCP
2024-11-25T17:38:25.777115+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49811	18.156.13.209	12824	TCP
2024-11-25T17:38:28.452694+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49818	18.156.13.209	12824	TCP
2024-11-25T17:38:28.452694+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49818	18.156.13.209	12824	TCP
2024-11-25T17:38:31.260758+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49824	18.156.13.209	12824	TCP
2024-11-25T17:38:31.260758+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49824	18.156.13.209	12824	TCP
2024-11-25T17:38:34.046872+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49831	18.156.13.209	12824	TCP
2024-11-25T17:38:34.046872+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49831	18.156.13.209	12824	TCP
2024-11-25T17:38:36.743738+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49837	18.156.13.209	12824	TCP
2024-11-25T17:38:36.743738+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49837	18.156.13.209	12824	TCP
2024-11-25T17:38:39.508878+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49845	18.156.13.209	12824	TCP
2024-11-25T17:38:39.508878+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49845	18.156.13.209	12824	TCP
2024-11-25T17:38:41.977698+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49851	18.156.13.209	12824	TCP
2024-11-25T17:38:41.977698+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49851	18.156.13.209	12824	TCP
2024-11-25T17:38:44.744336+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49858	18.156.13.209	12824	TCP
2024-11-25T17:38:44.744336+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49858	18.156.13.209	12824	TCP
2024-11-25T17:38:47.499598+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49865	18.156.13.209	12824	TCP
2024-11-25T17:38:47.499598+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49865	18.156.13.209	12824	TCP
2024-11-25T17:38:50.133869+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49871	18.156.13.209	12824	TCP
2024-11-25T17:38:50.133869+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49871	18.156.13.209	12824	TCP
2024-11-25T17:38:52.557329+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49878	18.156.13.209	12824	TCP
2024-11-25T17:38:52.557329+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49878	18.156.13.209	12824	TCP
2024-11-25T17:38:54.665521+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49882	18.156.13.209	12824	TCP
2024-11-25T17:38:54.665521+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49882	18.156.13.209	12824	TCP
2024-11-25T17:38:56.779763+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49887	18.156.13.209	12824	TCP
2024-11-25T17:38:56.779763+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49887	18.156.13.209	12824	TCP
2024-11-25T17:38:58.901645+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49891	18.156.13.209	12824	TCP
2024-11-25T17:38:58.901645+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49891	18.156.13.209	12824	TCP
2024-11-25T17:39:01.123394+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49898	18.156.13.209	12824	TCP
2024-11-25T17:39:01.123394+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49898	18.156.13.209	12824	TCP
2024-11-25T17:39:03.380994+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49903	18.156.13.209	12824	TCP
2024-11-25T17:39:03.380994+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49903	18.156.13.209	12824	TCP
2024-11-25T17:39:05.758016+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49909	18.156.13.209	12824	TCP
2024-11-25T17:39:05.758016+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49909	18.156.13.209	12824	TCP
2024-11-25T17:39:08.368868+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49916	18.192.93.86	12824	TCP
2024-11-25T17:39:08.368868+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49916	18.192.93.86	12824	TCP
2024-11-25T17:39:11.078657+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49922	18.192.93.86	12824	TCP
2024-11-25T17:39:11.078657+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49922	18.192.93.86	12824	TCP
2024-11-25T17:39:13.847332+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49927	18.192.93.86	12824	TCP
2024-11-25T17:39:13.847332+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49927	18.192.93.86	12824	TCP
2024-11-25T17:39:16.594388+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49933	18.192.93.86	12824	TCP
2024-11-25T17:39:16.594388+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49933	18.192.93.86	12824	TCP
2024-11-25T17:39:19.047135+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49939	18.192.93.86	12824	TCP
2024-11-25T17:39:19.047135+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49939	18.192.93.86	12824	TCP
2024-11-25T17:39:21.464134+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49944	18.192.93.86	12824	TCP
2024-11-25T17:39:21.464134+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49944	18.192.93.86	12824	TCP
2024-11-25T17:39:22.574522+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49944	18.192.93.86	12824	TCP
2024-11-25T17:39:23.634704+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49947	18.192.93.86	12824	TCP
2024-11-25T17:39:23.634704+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49947	18.192.93.86	12824	TCP
2024-11-25T17:39:25.385093+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49953	18.192.93.86	12824	TCP
2024-11-25T17:39:25.385093+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49953	18.192.93.86	12824	TCP
2024-11-25T17:39:27.565444+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49959	18.192.93.86	12824	TCP
2024-11-25T17:39:27.565444+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49959	18.192.93.86	12824	TCP
2024-11-25T17:39:29.720606+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49965	18.192.93.86	12824	TCP
2024-11-25T17:39:29.720606+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49965	18.192.93.86	12824	TCP
2024-11-25T17:39:30.996199+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49965	18.192.93.86	12824	TCP
2024-11-25T17:39:31.917091+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49968	18.192.93.86	12824	TCP
2024-11-25T17:39:31.917091+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49968	18.192.93.86	12824	TCP
2024-11-25T17:39:33.564055+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49972	18.192.93.86	12824	TCP
2024-11-25T17:39:33.564055+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49972	18.192.93.86	12824	TCP
2024-11-25T17:39:35.688781+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49978	18.192.93.86	12824	TCP
2024-11-25T17:39:35.688781+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49978	18.192.93.86	12824	TCP
2024-11-25T17:39:37.944784+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49981	18.192.93.86	12824	TCP
2024-11-25T17:39:37.944784+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49981	18.192.93.86	12824	TCP
2024-11-25T17:39:40.237683+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49987	18.192.93.86	12824	TCP
2024-11-25T17:39:40.237683+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49987	18.192.93.86	12824	TCP
2024-11-25T17:39:42.064892+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49993	18.192.93.86	12824	TCP
2024-11-25T17:39:42.064892+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49993	18.192.93.86	12824	TCP
2024-11-25T17:39:44.110749+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49999	18.192.93.86	12824	TCP
2024-11-25T17:39:44.110749+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49999	18.192.93.86	12824	TCP
2024-11-25T17:39:45.546330+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49999	18.192.93.86	12824	TCP
2024-11-25T17:39:46.354325+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50002	18.192.93.86	12824	TCP
2024-11-25T17:39:46.354325+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50002	18.192.93.86	12824	TCP
2024-11-25T17:39:48.360451+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50007	18.192.93.86	12824	TCP
2024-11-25T17:39:48.360451+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50007	18.192.93.86	12824	TCP
2024-11-25T17:39:49.969403+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50012	18.192.93.86	12824	TCP
2024-11-25T17:39:49.969403+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50012	18.192.93.86	12824	TCP
2024-11-25T17:39:50.528202+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50012	18.192.93.86	12824	TCP
2024-11-25T17:39:50.871101+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50012	18.192.93.86	12824	TCP
2024-11-25T17:39:52.281387+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50018	18.192.93.86	12824	TCP
2024-11-25T17:39:52.281387+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50018	18.192.93.86	12824	TCP
2024-11-25T17:39:54.344606+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50024	18.192.93.86	12824	TCP
2024-11-25T17:39:54.344606+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50024	18.192.93.86	12824	TCP
2024-11-25T17:39:56.532679+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50027	18.192.93.86	12824	TCP
2024-11-25T17:39:56.532679+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50027	18.192.93.86	12824	TCP
2024-11-25T17:39:57.043844+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50027	18.192.93.86	12824	TCP
2024-11-25T17:39:58.612439+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50032	18.192.93.86	12824	TCP
2024-11-25T17:39:58.612439+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50032	18.192.93.86	12824	TCP
2024-11-25T17:39:59.261927+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50032	18.192.93.86	12824	TCP
2024-11-25T17:40:00.203352+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50038	18.192.93.86	12824	TCP
2024-11-25T17:40:00.203352+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50038	18.192.93.86	12824	TCP
2024-11-25T17:40:00.985076+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50038	18.192.93.86	12824	TCP
2024-11-25T17:40:02.281888+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50042	18.192.93.86	12824	TCP
2024-11-25T17:40:02.281888+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50042	18.192.93.86	12824	TCP
2024-11-25T17:40:04.515928+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50048	18.192.93.86	12824	TCP
2024-11-25T17:40:04.515928+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50048	18.192.93.86	12824	TCP
2024-11-25T17:40:06.409213+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50052	18.192.93.86	12824	TCP
2024-11-25T17:40:06.409213+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50052	18.192.93.86	12824	TCP
2024-11-25T17:40:06.665114+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50052	18.192.93.86	12824	TCP
2024-11-25T17:40:08.533671+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50057	18.197.239.5	12824	TCP
2024-11-25T17:40:08.533671+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50057	18.197.239.5	12824	TCP
2024-11-25T17:40:10.643778+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50063	18.197.239.5	12824	TCP
2024-11-25T17:40:10.643778+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50063	18.197.239.5	12824	TCP
2024-11-25T17:40:12.774897+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50067	18.197.239.5	12824	TCP
2024-11-25T17:40:12.774897+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50067	18.197.239.5	12824	TCP
2024-11-25T17:40:14.940732+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50073	18.197.239.5	12824	TCP
2024-11-25T17:40:14.940732+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50073	18.197.239.5	12824	TCP
2024-11-25T17:40:16.531892+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50076	18.197.239.5	12824	TCP
2024-11-25T17:40:16.531892+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50076	18.197.239.5	12824	TCP
2024-11-25T17:40:18.918232+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50077	18.197.239.5	12824	TCP
2024-11-25T17:40:18.918232+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50077	18.197.239.5	12824	TCP
2024-11-25T17:40:20.923446+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50078	18.197.239.5	12824	TCP
2024-11-25T17:40:20.923446+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50078	18.197.239.5	12824	TCP
2024-11-25T17:40:23.003503+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50079	18.197.239.5	12824	TCP
2024-11-25T17:40:23.003503+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50079	18.197.239.5	12824	TCP
2024-11-25T17:40:24.969658+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50080	18.197.239.5	12824	TCP
2024-11-25T17:40:24.969658+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50080	18.197.239.5	12824	TCP
2024-11-25T17:40:27.229934+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50081	18.197.239.5	12824	TCP
2024-11-25T17:40:27.229934+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50081	18.197.239.5	12824	TCP
2024-11-25T17:40:29.342285+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50082	18.197.239.5	12824	TCP
2024-11-25T17:40:29.342285+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50082	18.197.239.5	12824	TCP
2024-11-25T17:40:29.645754+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50082	18.197.239.5	12824	TCP
2024-11-25T17:40:31.344912+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50083	18.197.239.5	12824	TCP
2024-11-25T17:40:31.344912+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50083	18.197.239.5	12824	TCP
2024-11-25T17:40:32.910359+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50084	18.197.239.5	12824	TCP
2024-11-25T17:40:32.910359+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50084	18.197.239.5	12824	TCP
2024-11-25T17:40:35.020544+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50085	18.197.239.5	12824	TCP
2024-11-25T17:40:35.020544+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50085	18.197.239.5	12824	TCP
2024-11-25T17:40:37.016662+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50086	18.197.239.5	12824	TCP
2024-11-25T17:40:37.016662+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50086	18.197.239.5	12824	TCP
2024-11-25T17:40:38.907187+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50087	18.197.239.5	12824	TCP
2024-11-25T17:40:38.907187+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50087	18.197.239.5	12824	TCP
2024-11-25T17:40:40.630164+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50088	18.197.239.5	12824	TCP
2024-11-25T17:40:40.630164+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50088	18.197.239.5	12824	TCP
2024-11-25T17:40:42.287464+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50089	18.197.239.5	12824	TCP
2024-11-25T17:40:42.287464+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50089	18.197.239.5	12824	TCP
2024-11-25T17:40:43.761798+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50090	18.197.239.5	12824	TCP
2024-11-25T17:40:43.761798+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50090	18.197.239.5	12824	TCP
2024-11-25T17:40:45.468544+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50091	18.197.239.5	12824	TCP
2024-11-25T17:40:45.468544+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50091	18.197.239.5	12824	TCP
2024-11-25T17:40:47.313028+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50092	18.197.239.5	12824	TCP
2024-11-25T17:40:47.313028+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50092	18.197.239.5	12824	TCP
2024-11-25T17:40:49.100588+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50093	18.197.239.5	12824	TCP
2024-11-25T17:40:49.100588+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50093	18.197.239.5	12824	TCP
2024-11-25T17:40:49.387296+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	50093	18.197.239.5	12824	TCP
2024-11-25T17:40:50.578687+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50094	18.197.239.5	12824	TCP
2024-11-25T17:40:50.578687+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50094	18.197.239.5	12824	TCP
2024-11-25T17:40:52.453488+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50095	18.197.239.5	12824	TCP
2024-11-25T17:40:52.453488+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50095	18.197.239.5	12824	TCP
2024-11-25T17:40:54.282842+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50096	18.197.239.5	12824	TCP
2024-11-25T17:40:54.282842+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50096	18.197.239.5	12824	TCP
2024-11-25T17:40:55.883918+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50097	18.197.239.5	12824	TCP
2024-11-25T17:40:55.883918+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50097	18.197.239.5	12824	TCP
2024-11-25T17:40:57.433066+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50098	18.197.239.5	12824	TCP
2024-11-25T17:40:57.433066+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50098	18.197.239.5	12824	TCP
2024-11-25T17:40:59.291685+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50099	18.197.239.5	12824	TCP
2024-11-25T17:40:59.291685+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50099	18.197.239.5	12824	TCP
2024-11-25T17:41:00.949983+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50100	18.197.239.5	12824	TCP
2024-11-25T17:41:00.949983+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50100	18.197.239.5	12824	TCP
2024-11-25T17:41:02.550162+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50101	18.197.239.5	12824	TCP
2024-11-25T17:41:02.550162+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50101	18.197.239.5	12824	TCP
2024-11-25T17:41:04.274777+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	50102	18.197.239.5	12824	TCP
2024-11-25T17:41:04.274777+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	50102	18.197.239.5	12824	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 17:37:05.390366077 CET	49730	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:05.511183977 CET	12824	49730	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:05.511274099 CET	49730	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:05.645457983 CET	49730	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:05.765448093 CET	12824	49730	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:05.765503883 CET	49730	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:05.885669947 CET	12824	49730	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:07.035363913 CET	12824	49730	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:07.035593033 CET	49730	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:09.045857906 CET	49730	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:09.047260046 CET	49731	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:09.170896053 CET	12824	49730	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:09.172139883 CET	12824	49731	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:09.172214985 CET	49731	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:09.173294067 CET	49731	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:09.293620110 CET	12824	49731	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:09.293710947 CET	49731	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:09.414917946 CET	12824	49731	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:10.844494104 CET	12824	49731	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:10.844676018 CET	49731	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:12.855587959 CET	49731	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:12.856587887 CET	49732	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:12.982407093 CET	12824	49731	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:12.983124018 CET	12824	49732	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:12.983309031 CET	49732	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:12.983922958 CET	49732	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:13.104773045 CET	12824	49732	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:13.104964972 CET	49732	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:13.225153923 CET	12824	49732	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:14.341418982 CET	12824	49732	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:14.341523886 CET	49732	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:16.355448008 CET	49732	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:16.356617928 CET	49733	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:16.476996899 CET	12824	49732	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:16.480335951 CET	12824	49733	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:16.480437040 CET	49733	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:16.481312037 CET	49733	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:16.604954958 CET	12824	49733	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:16.605010033 CET	49733	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:16.726243973 CET	12824	49733	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:17.924386978 CET	12824	49733	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:17.926104069 CET	49733	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:19.933501005 CET	49733	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:19.934959888 CET	49736	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:20.053678036 CET	12824	49733	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:20.055068970 CET	12824	49736	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:20.055207014 CET	49736	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:20.055877924 CET	49736	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:20.175857067 CET	12824	49736	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:20.175966024 CET	49736	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:20.296262980 CET	12824	49736	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:21.577419996 CET	12824	49736	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:21.577624083 CET	49736	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:23.589709997 CET	49736	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:23.590567112 CET	49740	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:23.713346004 CET	12824	49736	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:23.714066982 CET	12824	49740	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:23.718286991 CET	49740	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:23.718786001 CET	49740	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:23.838965893 CET	12824	49740	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:23.839029074 CET	49740	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:23.964176893 CET	12824	49740	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:25.098208904 CET	12824	49740	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:25.098293066 CET	49740	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:27.105298996 CET	49740	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:27.106518984 CET	49742	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:27.225842953 CET	12824	49740	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:27.226958990 CET	12824	49742	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:27.227190971 CET	49742	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:27.227896929 CET	49742	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:27.349701881 CET	12824	49742	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:27.349761963 CET	49742	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:27.473090887 CET	12824	49742	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:27.488424063 CET	49742	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:27.614661932 CET	12824	49742	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:28.869262934 CET	12824	49742	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:28.869343996 CET	49742	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:30.870965004 CET	49742	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:30.872396946 CET	49743	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:30.991146088 CET	12824	49742	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:30.992480040 CET	12824	49743	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:30.992707968 CET	49743	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:30.993211031 CET	49743	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:31.113328934 CET	12824	49743	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:31.113410950 CET	49743	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:31.233573914 CET	12824	49743	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:32.384622097 CET	12824	49743	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:32.384757042 CET	49743	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:34.386688948 CET	49743	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:34.388976097 CET	49744	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:34.507236004 CET	12824	49743	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:34.509382010 CET	12824	49744	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:34.509454966 CET	49744	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:34.511538982 CET	49744	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:34.633444071 CET	12824	49744	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:34.633518934 CET	49744	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:34.753649950 CET	12824	49744	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:35.611146927 CET	49744	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:35.733108997 CET	12824	49744	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:35.813036919 CET	12824	49744	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:35.813204050 CET	49744	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:37.824182034 CET	49744	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:37.825635910 CET	49745	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:37.944628000 CET	12824	49744	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:37.945669889 CET	12824	49745	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:37.945875883 CET	49745	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:37.946486950 CET	49745	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:38.066651106 CET	12824	49745	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:38.066819906 CET	49745	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:38.190080881 CET	12824	49745	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:39.585867882 CET	12824	49745	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:39.585954905 CET	49745	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:41.589725971 CET	49745	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:41.591299057 CET	49746	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:41.709995985 CET	12824	49745	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:41.711379051 CET	12824	49746	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:41.711450100 CET	49746	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:41.712320089 CET	49746	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:41.832474947 CET	12824	49746	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:41.832536936 CET	49746	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:41.952682972 CET	12824	49746	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:42.574744940 CET	49746	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:42.697671890 CET	12824	49746	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:43.266458035 CET	12824	49746	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:43.266537905 CET	49746	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:45.277255058 CET	49746	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:45.278187037 CET	49747	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:45.404392004 CET	12824	49746	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:45.404973030 CET	12824	49747	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:45.405066013 CET	49747	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:45.405759096 CET	49747	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:45.527607918 CET	12824	49747	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:45.527705908 CET	49747	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:45.647881985 CET	12824	49747	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:46.878285885 CET	12824	49747	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:46.878369093 CET	49747	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:48.886835098 CET	49747	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:48.888520956 CET	49748	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:49.009244919 CET	12824	49747	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:49.010680914 CET	12824	49748	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:49.010776043 CET	49748	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:49.026427984 CET	49748	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:49.147572994 CET	12824	49748	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:49.147756100 CET	49748	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:49.268579960 CET	12824	49748	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:50.494189978 CET	12824	49748	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:50.494281054 CET	49748	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:52.495975971 CET	49748	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:52.497562885 CET	49749	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:52.616516113 CET	12824	49748	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:52.617677927 CET	12824	49749	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:52.617758989 CET	49749	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:52.618515015 CET	49749	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:52.739203930 CET	12824	49749	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:52.739272118 CET	49749	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:52.862226963 CET	12824	49749	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:54.066910982 CET	12824	49749	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:54.067008972 CET	49749	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:56.074220896 CET	49749	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:56.075385094 CET	49750	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:56.194679022 CET	12824	49749	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:56.195389986 CET	12824	49750	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:56.195570946 CET	49750	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:56.196588039 CET	49750	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:56.316660881 CET	12824	49750	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:56.316879034 CET	49750	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:56.438235998 CET	12824	49750	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:57.926135063 CET	12824	49750	3.126.37.18	192.168.2.4
Nov 25, 2024 17:37:57.926224947 CET	49750	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:59.933470964 CET	49750	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:37:59.934560061 CET	49753	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:00.054342985 CET	12824	49750	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:00.055458069 CET	12824	49753	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:00.055552006 CET	49753	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:00.056353092 CET	49753	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:00.179187059 CET	12824	49753	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:00.182791948 CET	49753	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:00.302927971 CET	12824	49753	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:01.401604891 CET	12824	49753	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:01.401671886 CET	49753	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:03.418013096 CET	49753	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:03.419843912 CET	49759	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:03.538268089 CET	12824	49753	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:03.539822102 CET	12824	49759	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:03.539901018 CET	49759	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:03.557266951 CET	49759	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:03.677424908 CET	12824	49759	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:03.677608967 CET	49759	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:03.797856092 CET	12824	49759	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:04.427567005 CET	49759	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:04.547638893 CET	12824	49759	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:04.927627087 CET	12824	49759	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:04.927689075 CET	49759	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:06.808737993 CET	49759	12824	192.168.2.4	3.126.37.18
Nov 25, 2024 17:38:06.928956032 CET	12824	49759	3.126.37.18	192.168.2.4
Nov 25, 2024 17:38:07.044218063 CET	49765	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:07.171135902 CET	12824	49765	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:07.171252012 CET	49765	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:07.186505079 CET	49765	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:07.310977936 CET	12824	49765	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:07.311042070 CET	49765	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:07.431298018 CET	12824	49765	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:07.431360960 CET	49765	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:07.551531076 CET	12824	49765	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:08.725128889 CET	12824	49765	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:08.725387096 CET	49765	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:10.480881929 CET	49765	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:10.487535954 CET	49776	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:10.607033968 CET	12824	49765	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:10.613296986 CET	12824	49776	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:10.613487959 CET	49776	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:10.614624977 CET	49776	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:10.734863997 CET	12824	49776	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:10.735006094 CET	49776	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:10.855187893 CET	12824	49776	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:12.051789045 CET	12824	49776	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:12.051996946 CET	49776	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:13.683526039 CET	49776	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:13.686728954 CET	49782	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:13.803951025 CET	12824	49776	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:13.807060003 CET	12824	49782	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:13.807154894 CET	49782	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:13.808394909 CET	49782	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:13.932466030 CET	12824	49782	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:13.932607889 CET	49782	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:14.055202007 CET	12824	49782	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:15.338596106 CET	12824	49782	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:15.338701963 CET	49782	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:16.872220039 CET	49782	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:16.896709919 CET	49788	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:16.992495060 CET	12824	49782	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:17.018302917 CET	12824	49788	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:17.018388033 CET	49788	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:17.020519018 CET	49788	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:17.414541960 CET	12824	49788	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:17.414621115 CET	49788	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:17.534774065 CET	12824	49788	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:18.626784086 CET	12824	49788	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:18.630100965 CET	49788	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:20.062398911 CET	49788	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:20.068039894 CET	49798	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:20.182521105 CET	12824	49788	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:20.188076019 CET	12824	49798	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:20.188184023 CET	49798	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:20.189800978 CET	49798	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:20.310441971 CET	12824	49798	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:20.310498953 CET	49798	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:20.430607080 CET	12824	49798	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:21.591434002 CET	12824	49798	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:21.591609955 CET	49798	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:22.917927980 CET	49798	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:22.919012070 CET	49804	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:23.043735027 CET	12824	49798	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:23.044781923 CET	12824	49804	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:23.044857025 CET	49804	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:23.045830011 CET	49804	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:23.173856020 CET	12824	49804	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:23.173911095 CET	49804	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:23.351906061 CET	12824	49804	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:24.417893887 CET	12824	49804	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:24.417978048 CET	49804	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:25.652404070 CET	49804	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:25.653482914 CET	49811	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:25.772855043 CET	12824	49804	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:25.773602009 CET	12824	49811	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:25.773691893 CET	49811	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:25.777115107 CET	49811	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:25.903345108 CET	12824	49811	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:25.903836966 CET	49811	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:26.023870945 CET	12824	49811	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:27.166013956 CET	12824	49811	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:27.166091919 CET	49811	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:28.324178934 CET	49811	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:28.325186014 CET	49818	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:28.450666904 CET	12824	49811	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:28.451611042 CET	12824	49818	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:28.451752901 CET	49818	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:28.452693939 CET	49818	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:28.574357986 CET	12824	49818	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:28.574456930 CET	49818	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:28.696145058 CET	12824	49818	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:30.047749043 CET	12824	49818	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:30.048072100 CET	49818	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:31.138232946 CET	49818	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:31.139204025 CET	49824	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:31.258958101 CET	12824	49818	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:31.259773016 CET	12824	49824	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:31.259850025 CET	49824	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:31.260757923 CET	49824	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:31.380728006 CET	12824	49824	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:31.380783081 CET	49824	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:31.500917912 CET	12824	49824	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:32.908560991 CET	12824	49824	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:32.908660889 CET	49824	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:33.917974949 CET	49824	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:33.919105053 CET	49831	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:34.044779062 CET	12824	49824	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:34.045681000 CET	12824	49831	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:34.045783997 CET	49831	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:34.046871901 CET	49831	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:34.171740055 CET	12824	49831	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:34.172171116 CET	49831	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:34.297396898 CET	12824	49831	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:35.646737099 CET	12824	49831	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:35.648086071 CET	49831	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:36.589827061 CET	49831	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:36.590945005 CET	49837	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:36.709917068 CET	12824	49831	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:36.742702007 CET	12824	49837	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:36.742932081 CET	49837	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:36.743737936 CET	49837	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:36.863745928 CET	12824	49837	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:36.863846064 CET	49837	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:36.983839989 CET	12824	49837	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:38.498825073 CET	12824	49837	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:38.499030113 CET	49837	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:39.386874914 CET	49837	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:39.387912989 CET	49845	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:39.506947041 CET	12824	49837	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:39.507849932 CET	12824	49845	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:39.507936954 CET	49845	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:39.508877993 CET	49845	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:39.628846884 CET	12824	49845	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:39.628917933 CET	49845	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:39.748958111 CET	12824	49845	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:41.030947924 CET	12824	49845	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:41.031181097 CET	49845	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:41.855436087 CET	49845	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:41.856422901 CET	49851	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:41.975449085 CET	12824	49845	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:41.976638079 CET	12824	49851	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:41.976821899 CET	49851	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:41.977698088 CET	49851	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:42.097719908 CET	12824	49851	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:42.097831964 CET	49851	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:42.218332052 CET	12824	49851	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:43.847454071 CET	12824	49851	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:43.847506046 CET	49851	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:44.621058941 CET	49851	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:44.621964931 CET	49858	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:44.742207050 CET	12824	49851	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:44.743042946 CET	12824	49858	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:44.743129015 CET	49858	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:44.744335890 CET	49858	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:44.864290953 CET	12824	49858	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:44.864361048 CET	49858	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:44.987957954 CET	12824	49858	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:46.646126032 CET	12824	49858	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:46.646183968 CET	49858	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:47.371260881 CET	49858	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:47.372677088 CET	49865	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:47.496732950 CET	12824	49858	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:47.497811079 CET	12824	49865	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:47.497911930 CET	49865	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:47.499598026 CET	49865	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:47.619528055 CET	12824	49865	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:47.619679928 CET	49865	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:47.739790916 CET	12824	49865	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:49.337873936 CET	12824	49865	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:49.337928057 CET	49865	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:50.011742115 CET	49865	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:50.012806892 CET	49871	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:50.131962061 CET	12824	49865	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:50.132888079 CET	12824	49871	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:50.132956028 CET	49871	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:50.133868933 CET	49871	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:50.256853104 CET	12824	49871	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:50.256939888 CET	49871	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:50.383747101 CET	12824	49871	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:51.804527044 CET	12824	49871	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:51.805003881 CET	49871	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:52.433798075 CET	49871	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:52.435339928 CET	49878	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:52.554838896 CET	12824	49871	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:52.556340933 CET	12824	49878	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:52.556565046 CET	49878	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:52.557328939 CET	49878	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:52.679177999 CET	12824	49878	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:52.679305077 CET	49878	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:52.802879095 CET	12824	49878	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:53.964950085 CET	12824	49878	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:53.965003014 CET	49878	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:54.542987108 CET	49878	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:54.544198036 CET	49882	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:54.663547993 CET	12824	49878	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:54.664448977 CET	12824	49882	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:54.664518118 CET	49882	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:54.665520906 CET	49882	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:54.785824060 CET	12824	49882	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:54.785882950 CET	49882	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:54.906981945 CET	12824	49882	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:56.088918924 CET	12824	49882	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:56.091160059 CET	49882	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:56.653189898 CET	49882	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:56.657876015 CET	49887	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:56.773945093 CET	12824	49882	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:56.778573990 CET	12824	49887	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:56.778670073 CET	49887	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:56.779762983 CET	49887	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:56.899785042 CET	12824	49887	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:56.899840117 CET	49887	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:57.020241022 CET	12824	49887	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:58.268635035 CET	12824	49887	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:58.268704891 CET	49887	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:58.777456999 CET	49887	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:58.778491974 CET	49891	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:58.899542093 CET	12824	49887	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:58.900587082 CET	12824	49891	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:58.900755882 CET	49891	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:58.901644945 CET	49891	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:59.025057077 CET	12824	49891	18.156.13.209	192.168.2.4
Nov 25, 2024 17:38:59.025136948 CET	49891	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:38:59.151916027 CET	12824	49891	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:00.516755104 CET	12824	49891	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:00.516856909 CET	49891	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:00.996130943 CET	49891	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:00.997009993 CET	49898	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:01.116446018 CET	12824	49891	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:01.118242025 CET	12824	49898	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:01.122524977 CET	49898	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:01.123394012 CET	49898	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:01.243278027 CET	12824	49898	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:01.246229887 CET	49898	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:01.369102955 CET	12824	49898	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:02.791382074 CET	12824	49898	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:02.791461945 CET	49898	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:03.232795954 CET	49898	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:03.239950895 CET	49903	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:03.353446007 CET	12824	49898	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:03.359954119 CET	12824	49903	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:03.362189054 CET	49903	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:03.380994081 CET	49903	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:03.500983953 CET	12824	49903	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:03.502126932 CET	49903	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:03.622081995 CET	12824	49903	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:05.215420961 CET	12824	49903	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:05.215492010 CET	49903	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:05.636676073 CET	49903	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:05.637427092 CET	49909	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:05.756730080 CET	12824	49903	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:05.757354021 CET	12824	49909	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:05.757438898 CET	49909	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:05.758016109 CET	49909	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:05.878096104 CET	12824	49909	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:05.878182888 CET	49909	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:05.998107910 CET	12824	49909	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:07.616302967 CET	12824	49909	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:07.616390944 CET	49909	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:08.011708021 CET	49909	12824	192.168.2.4	18.156.13.209
Nov 25, 2024 17:39:08.133363008 CET	12824	49909	18.156.13.209	192.168.2.4
Nov 25, 2024 17:39:08.247479916 CET	49916	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:08.367614031 CET	12824	49916	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:08.367693901 CET	49916	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:08.368868113 CET	49916	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:08.488941908 CET	12824	49916	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:08.489006996 CET	49916	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:08.609086037 CET	12824	49916	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:10.431494951 CET	12824	49916	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:10.432161093 CET	49916	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:10.792996883 CET	49916	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:10.793910027 CET	49922	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:11.077672005 CET	12824	49916	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:11.077717066 CET	12824	49922	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:11.077790022 CET	49922	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:11.078656912 CET	49922	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:11.545886040 CET	12824	49922	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:11.545958996 CET	49922	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:12.339775085 CET	49922	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:12.454519033 CET	12824	49922	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:12.673568010 CET	12824	49922	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:13.125572920 CET	12824	49922	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:13.127784014 CET	49922	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:13.465194941 CET	49922	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:13.490257025 CET	49927	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:13.593044996 CET	12824	49922	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:13.846266985 CET	12824	49927	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:13.846692085 CET	49927	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:13.847332001 CET	49927	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:13.974894047 CET	12824	49927	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:13.974971056 CET	49927	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:14.225555897 CET	12824	49927	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:15.915724039 CET	12824	49927	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:15.915813923 CET	49927	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:16.231235027 CET	49927	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:16.232189894 CET	49933	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:16.593605995 CET	12824	49927	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:16.593653917 CET	12824	49933	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:16.593739033 CET	49933	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:16.594388008 CET	49933	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:16.949325085 CET	12824	49933	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:16.949470997 CET	49933	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:17.077750921 CET	12824	49933	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:18.621828079 CET	12824	49933	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:18.621995926 CET	49933	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:18.917979956 CET	49933	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:18.918752909 CET	49939	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:19.045881987 CET	12824	49933	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:19.046427965 CET	12824	49939	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:19.046524048 CET	49939	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:19.047135115 CET	49939	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:19.393841028 CET	12824	49939	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:19.393961906 CET	49939	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:19.522141933 CET	12824	49939	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:20.816957951 CET	12824	49939	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:20.817024946 CET	49939	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:21.101079941 CET	49939	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:21.105674982 CET	49944	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:21.286120892 CET	12824	49939	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:21.461147070 CET	12824	49944	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:21.463280916 CET	49944	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:21.464133978 CET	49944	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:21.591458082 CET	12824	49944	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:21.591531038 CET	49944	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:21.719661951 CET	12824	49944	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:22.574522018 CET	49944	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:22.701880932 CET	12824	49944	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:23.185590982 CET	12824	49944	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:23.185702085 CET	49944	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:23.454190016 CET	49944	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:23.455209970 CET	49947	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:23.581645012 CET	12824	49944	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:23.634133101 CET	12824	49947	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:23.634203911 CET	49947	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:23.634704113 CET	49947	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:23.837806940 CET	12824	49947	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:23.837857008 CET	49947	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:23.965723038 CET	12824	49947	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:25.004806995 CET	12824	49947	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:25.004883051 CET	49947	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:25.253443956 CET	49947	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:25.254542112 CET	49953	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:25.383152008 CET	12824	49947	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:25.384152889 CET	12824	49953	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:25.384572983 CET	49953	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:25.385092974 CET	49953	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:25.512979031 CET	12824	49953	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:25.513087034 CET	49953	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:25.641658068 CET	12824	49953	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:27.205904007 CET	12824	49953	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:27.206233025 CET	49953	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:27.433644056 CET	49953	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:27.434453964 CET	49959	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:27.561063051 CET	12824	49953	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:27.561976910 CET	12824	49959	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:27.562067986 CET	49959	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:27.565443993 CET	49959	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:27.693116903 CET	12824	49959	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:27.693183899 CET	49959	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:27.820739031 CET	12824	49959	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:29.382765055 CET	12824	49959	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:29.382828951 CET	49959	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:29.589916945 CET	49959	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:29.591032982 CET	49965	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:29.718760967 CET	12824	49959	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:29.719705105 CET	12824	49965	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:29.719773054 CET	49965	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:29.720606089 CET	49965	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:29.848202944 CET	12824	49965	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:29.848268032 CET	49965	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:30.077420950 CET	12824	49965	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:30.996198893 CET	49965	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:31.186423063 CET	12824	49965	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:31.520582914 CET	12824	49965	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:31.520720005 CET	49965	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:31.730798960 CET	49965	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:31.751653910 CET	49968	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:31.909672976 CET	12824	49965	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:31.909684896 CET	12824	49968	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:31.909761906 CET	49968	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:31.917090893 CET	49968	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:32.044718981 CET	12824	49968	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:32.044770002 CET	49968	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:32.172944069 CET	12824	49968	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:33.241401911 CET	12824	49968	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:33.241556883 CET	49968	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:33.433669090 CET	49968	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:33.434715033 CET	49972	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:33.562954903 CET	12824	49968	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:33.563503027 CET	12824	49972	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:33.563580990 CET	49972	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:33.564054966 CET	49972	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:33.855504036 CET	12824	49972	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:33.855585098 CET	49972	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:33.985861063 CET	12824	49972	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:35.389305115 CET	12824	49972	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:35.389388084 CET	49972	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:35.558619976 CET	49972	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:35.559489012 CET	49978	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:35.686580896 CET	12824	49972	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:35.687660933 CET	12824	49978	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:35.687738895 CET	49978	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:35.688781023 CET	49978	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:35.993927002 CET	12824	49978	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:35.994014025 CET	49978	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:36.329436064 CET	12824	49978	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:37.480015993 CET	12824	49978	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:37.480200052 CET	49978	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:37.657260895 CET	49978	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:37.687141895 CET	49981	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:37.943372011 CET	12824	49978	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:37.943398952 CET	12824	49981	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:37.943555117 CET	49981	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:37.944783926 CET	49981	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:38.072268009 CET	12824	49981	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:38.072329998 CET	49981	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:38.361498117 CET	12824	49981	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:39.767853022 CET	12824	49981	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:39.768188000 CET	49981	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:39.918191910 CET	49981	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:39.918890953 CET	49987	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:40.236876011 CET	12824	49981	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:40.236949921 CET	12824	49987	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:40.237169027 CET	49987	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:40.237683058 CET	49987	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:40.365080118 CET	12824	49987	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:40.368256092 CET	49987	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:40.657623053 CET	12824	49987	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:41.664649010 CET	12824	49987	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:41.664757967 CET	49987	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:41.808633089 CET	49987	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:41.809437037 CET	49993	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:42.064285040 CET	12824	49987	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:42.064337015 CET	12824	49993	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:42.064429998 CET	49993	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:42.064892054 CET	49993	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:42.194006920 CET	12824	49993	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:42.196180105 CET	49993	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:42.324306965 CET	12824	49993	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:43.570086002 CET	12824	49993	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:43.570204020 CET	49993	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:43.724827051 CET	49993	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:43.729787111 CET	49999	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:43.981165886 CET	12824	49993	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:44.109813929 CET	12824	49999	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:44.109900951 CET	49999	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:44.110749006 CET	49999	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:44.238435984 CET	12824	49999	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:44.238615036 CET	49999	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:44.366275072 CET	12824	49999	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:45.546329975 CET	49999	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:45.673899889 CET	12824	49999	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:45.916233063 CET	12824	49999	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:45.916295052 CET	49999	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:46.043333054 CET	49999	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:46.044327021 CET	50002	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:46.337476969 CET	12824	49999	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:46.337580919 CET	12824	50002	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:46.337721109 CET	50002	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:46.354325056 CET	50002	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:46.721064091 CET	12824	50002	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:46.722331047 CET	50002	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:46.849881887 CET	12824	50002	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:48.118746996 CET	12824	50002	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:48.118813992 CET	50002	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:48.230530977 CET	50002	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:48.231301069 CET	50007	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:48.358798027 CET	12824	50002	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:48.359720945 CET	12824	50007	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:48.359944105 CET	50007	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:48.360450983 CET	50007	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:48.488223076 CET	12824	50007	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:48.488279104 CET	50007	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:48.615686893 CET	12824	50007	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:49.721158981 CET	12824	50007	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:49.721268892 CET	50007	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:49.839919090 CET	50007	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:49.840958118 CET	50012	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:49.967674971 CET	12824	50007	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:49.968508959 CET	12824	50012	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:49.968596935 CET	50012	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:49.969403028 CET	50012	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:50.096733093 CET	12824	50012	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:50.096900940 CET	50012	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:50.223920107 CET	12824	50012	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:50.528202057 CET	50012	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:50.871100903 CET	50012	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:50.953607082 CET	12824	50012	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:50.998851061 CET	12824	50012	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:52.041964054 CET	12824	50012	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:52.042304039 CET	50012	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:52.152400017 CET	50012	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:52.153115034 CET	50018	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:52.279973030 CET	12824	50012	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:52.280641079 CET	12824	50018	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:52.280782938 CET	50018	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:52.281387091 CET	50018	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:52.408977032 CET	12824	50018	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:52.410419941 CET	50018	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:52.538032055 CET	12824	50018	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:54.117552996 CET	12824	50018	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:54.117643118 CET	50018	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:54.215066910 CET	50018	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:54.216073036 CET	50024	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:54.342678070 CET	12824	50018	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:54.343708038 CET	12824	50024	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:54.343791962 CET	50024	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:54.344605923 CET	50024	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:54.472151041 CET	12824	50024	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:54.472239971 CET	50024	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:54.600644112 CET	12824	50024	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:56.313612938 CET	12824	50024	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:56.313687086 CET	50024	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:56.402687073 CET	50024	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:56.404387951 CET	50027	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:56.530139923 CET	12824	50024	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:56.531744957 CET	12824	50027	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:56.531831980 CET	50027	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:56.532679081 CET	50027	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:56.849746943 CET	12824	50027	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:56.849807024 CET	50027	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:56.977751017 CET	12824	50027	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:57.043843985 CET	50027	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:57.171372890 CET	12824	50027	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:58.400819063 CET	12824	50027	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:58.400881052 CET	50027	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:58.482284069 CET	50027	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:58.484193087 CET	50032	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:58.609818935 CET	12824	50027	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:58.611479044 CET	12824	50032	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:58.611565113 CET	50032	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:58.612438917 CET	50032	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:58.739861965 CET	12824	50032	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:58.739937067 CET	50032	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:58.866970062 CET	12824	50032	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:59.261926889 CET	50032	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:39:59.389508963 CET	12824	50032	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:59.999145985 CET	12824	50032	18.192.93.86	192.168.2.4
Nov 25, 2024 17:39:59.999202967 CET	50032	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:00.074388027 CET	50032	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:00.075047970 CET	50038	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:00.201869965 CET	12824	50032	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:00.202750921 CET	12824	50038	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:00.202944040 CET	50038	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:00.203351974 CET	50038	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:00.330981970 CET	12824	50038	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:00.331168890 CET	50038	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:00.458870888 CET	12824	50038	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:00.985075951 CET	50038	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:01.112833977 CET	12824	50038	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:02.078346968 CET	12824	50038	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:02.078413963 CET	50038	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:02.152460098 CET	50038	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:02.153332949 CET	50042	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:02.280175924 CET	12824	50038	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:02.280900955 CET	12824	50042	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:02.280987024 CET	50042	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:02.281888008 CET	50042	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:02.409342051 CET	12824	50042	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:02.409533978 CET	50042	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:02.536974907 CET	12824	50042	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:04.309516907 CET	12824	50042	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:04.309612036 CET	50042	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:04.386847019 CET	50042	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:04.387887955 CET	50048	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:04.514333010 CET	12824	50042	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:04.515146017 CET	12824	50048	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:04.515242100 CET	50048	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:04.515928030 CET	50048	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:04.643466949 CET	12824	50048	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:04.643541098 CET	50048	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:04.771135092 CET	12824	50048	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:06.209826946 CET	12824	50048	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:06.209896088 CET	50048	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:06.277899981 CET	50048	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:06.280641079 CET	50052	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:06.405366898 CET	12824	50048	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:06.408298016 CET	12824	50052	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:06.408648968 CET	50052	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:06.409213066 CET	50052	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:06.536943913 CET	12824	50052	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:06.537281990 CET	50052	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:06.664830923 CET	12824	50052	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:06.665113926 CET	50052	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:06.792931080 CET	12824	50052	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:08.108159065 CET	12824	50052	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:08.108261108 CET	50052	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:08.171894073 CET	50052	12824	192.168.2.4	18.192.93.86
Nov 25, 2024 17:40:08.299724102 CET	12824	50052	18.192.93.86	192.168.2.4
Nov 25, 2024 17:40:08.405019999 CET	50057	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:08.532702923 CET	12824	50057	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:08.532777071 CET	50057	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:08.533670902 CET	50057	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:08.661015034 CET	12824	50057	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:08.661096096 CET	50057	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:09.005068064 CET	12824	50057	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:10.445595026 CET	12824	50057	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:10.445677996 CET	50057	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:10.513257027 CET	50057	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:10.514971972 CET	50063	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:10.641889095 CET	12824	50057	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:10.642786026 CET	12824	50063	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:10.642914057 CET	50063	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:10.643778086 CET	50063	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:10.772284031 CET	12824	50063	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:10.776228905 CET	50063	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:10.903362036 CET	12824	50063	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:12.471092939 CET	12824	50063	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:12.471165895 CET	50063	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:12.527744055 CET	50063	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:12.531426907 CET	50067	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:12.769675016 CET	12824	50063	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:12.769730091 CET	12824	50067	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:12.769835949 CET	50067	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:12.774897099 CET	50067	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:12.902435064 CET	12824	50067	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:12.902519941 CET	50067	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:13.030119896 CET	12824	50067	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:14.753621101 CET	12824	50067	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:14.753736019 CET	50067	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:14.809137106 CET	50067	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:14.812228918 CET	50073	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:14.936695099 CET	12824	50067	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:14.939798117 CET	12824	50073	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:14.939920902 CET	50073	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:14.940732002 CET	50073	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:15.068267107 CET	12824	50073	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:15.068356991 CET	50073	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:15.195729017 CET	12824	50073	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:16.345058918 CET	12824	50073	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:16.347992897 CET	50073	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:16.402523041 CET	50073	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:16.403546095 CET	50076	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:16.530164957 CET	12824	50073	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:16.530949116 CET	12824	50076	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:16.531044006 CET	50076	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:16.531892061 CET	50076	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:16.659363031 CET	12824	50076	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:16.660281897 CET	50076	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:17.058660984 CET	50076	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:17.075740099 CET	12824	50076	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:17.186923981 CET	12824	50076	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:18.725608110 CET	12824	50076	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:18.725687027 CET	50076	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:18.787933111 CET	50076	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:18.789253950 CET	50077	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:18.915935040 CET	12824	50076	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:18.917151928 CET	12824	50077	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:18.917268038 CET	50077	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:18.918231964 CET	50077	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:19.045728922 CET	12824	50077	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:19.045815945 CET	50077	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:19.173788071 CET	12824	50077	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:20.743041039 CET	12824	50077	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:20.743112087 CET	50077	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:20.793117046 CET	50077	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:20.793951035 CET	50078	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:20.921622038 CET	12824	50077	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:20.922462940 CET	12824	50078	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:20.922569036 CET	50078	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:20.923445940 CET	50078	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:21.051188946 CET	12824	50078	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:21.051249027 CET	50078	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:21.179117918 CET	12824	50078	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:22.830573082 CET	12824	50078	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:22.830660105 CET	50078	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:22.871335030 CET	50078	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:22.872304916 CET	50079	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:22.998845100 CET	12824	50078	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:22.999588966 CET	12824	50079	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:22.999666929 CET	50079	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:23.003503084 CET	50079	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:23.132328033 CET	12824	50079	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:23.132400990 CET	50079	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:23.260003090 CET	12824	50079	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:24.794456005 CET	12824	50079	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:24.794550896 CET	50079	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:24.840085030 CET	50079	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:24.841017962 CET	50080	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:24.967806101 CET	12824	50079	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:24.968645096 CET	12824	50080	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:24.968740940 CET	50080	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:24.969657898 CET	50080	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:25.371203899 CET	50080	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:25.445442915 CET	12824	50080	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:25.445493937 CET	50080	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:25.498776913 CET	12824	50080	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:25.573234081 CET	12824	50080	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:27.049484015 CET	12824	50080	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:27.049544096 CET	50080	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:27.090954065 CET	50080	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:27.096565962 CET	50081	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:27.173827887 CET	12824	50080	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:27.173878908 CET	50080	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:27.218858004 CET	12824	50080	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:27.224298000 CET	12824	50081	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:27.224373102 CET	50081	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:27.229933977 CET	50081	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:27.357696056 CET	12824	50081	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:27.357762098 CET	50081	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:27.485213995 CET	12824	50081	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:29.009951115 CET	12824	50081	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:29.012279987 CET	50081	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:29.043216944 CET	50081	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:29.044122934 CET	50082	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:29.341320992 CET	12824	50081	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:29.341348886 CET	12824	50082	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:29.341434956 CET	50082	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:29.342284918 CET	50082	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:29.469703913 CET	12824	50082	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:29.469952106 CET	50082	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:29.597680092 CET	12824	50082	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:29.645754099 CET	50082	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:29.773510933 CET	12824	50082	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:31.172564030 CET	12824	50082	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:31.174407959 CET	50082	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:31.214983940 CET	50082	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:31.215917110 CET	50083	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:31.342236996 CET	12824	50082	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:31.343431950 CET	12824	50083	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:31.343517065 CET	50083	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:31.344912052 CET	50083	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:31.472635031 CET	12824	50083	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:31.474569082 CET	50083	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:31.602452040 CET	12824	50083	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:32.752371073 CET	12824	50083	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:32.752585888 CET	50083	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:32.777534008 CET	50083	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:32.778584957 CET	50084	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:32.905236959 CET	12824	50083	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:32.906153917 CET	12824	50084	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:32.906251907 CET	50084	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:32.910358906 CET	50084	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:33.038032055 CET	12824	50084	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:33.038100958 CET	50084	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:33.166021109 CET	12824	50084	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:34.721967936 CET	12824	50084	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:34.722070932 CET	50084	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:34.817905903 CET	50084	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:34.892146111 CET	50085	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:34.945332050 CET	12824	50084	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:35.019556999 CET	12824	50085	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:35.019655943 CET	50085	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:35.020544052 CET	50085	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:35.148062944 CET	12824	50085	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:35.148132086 CET	50085	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:35.275700092 CET	12824	50085	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:36.855994940 CET	12824	50085	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:36.858661890 CET	50085	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:36.887092113 CET	50085	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:36.888009071 CET	50086	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:37.014578104 CET	12824	50085	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:37.015594959 CET	12824	50086	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:37.015676975 CET	50086	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:37.016661882 CET	50086	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:37.144109964 CET	12824	50086	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:37.144188881 CET	50086	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:37.271704912 CET	12824	50086	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:38.742012978 CET	12824	50086	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:38.742208004 CET	50086	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:38.777592897 CET	50086	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:38.778527975 CET	50087	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:38.905015945 CET	12824	50086	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:38.905957937 CET	12824	50087	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:38.906044960 CET	50087	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:38.907186985 CET	50087	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:39.034861088 CET	12824	50087	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:39.034938097 CET	50087	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:39.162708998 CET	12824	50087	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:40.472007036 CET	12824	50087	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:40.472223997 CET	50087	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:40.496320009 CET	50087	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:40.499422073 CET	50088	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:40.623822927 CET	12824	50087	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:40.627109051 CET	12824	50088	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:40.627176046 CET	50088	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:40.630163908 CET	50088	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:40.758088112 CET	12824	50088	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:40.758167028 CET	50088	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:40.885642052 CET	12824	50088	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:42.132198095 CET	12824	50088	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:42.134763956 CET	50088	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:42.152554989 CET	50088	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:42.156302929 CET	50089	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:42.280759096 CET	12824	50088	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:42.284224033 CET	12824	50089	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:42.286700964 CET	50089	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:42.287463903 CET	50089	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:42.414838076 CET	12824	50089	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:42.418361902 CET	50089	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:42.545692921 CET	12824	50089	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:43.611201048 CET	12824	50089	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:43.611397982 CET	50089	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:43.638438940 CET	50089	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:43.640284061 CET	50090	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:43.758900881 CET	12824	50089	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:43.760796070 CET	12824	50090	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:43.760881901 CET	50090	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:43.761797905 CET	50090	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:43.883095980 CET	12824	50090	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:43.883157969 CET	50090	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:44.003876925 CET	12824	50090	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:45.319283962 CET	12824	50090	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:45.319475889 CET	50090	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:45.340233088 CET	50090	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:45.342407942 CET	50091	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:45.466466904 CET	12824	50090	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:45.467959881 CET	12824	50091	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:45.468143940 CET	50091	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:45.468544006 CET	50091	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:45.594609022 CET	12824	50091	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:45.594687939 CET	50091	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:45.722460032 CET	12824	50091	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:47.158221006 CET	12824	50091	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:47.162587881 CET	50091	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:47.183752060 CET	50091	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:47.184669018 CET	50092	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:47.310990095 CET	12824	50091	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:47.312133074 CET	12824	50092	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:47.312230110 CET	50092	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:47.313028097 CET	50092	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:47.440649986 CET	12824	50092	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:47.442322969 CET	50092	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:47.569730043 CET	12824	50092	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:48.942243099 CET	12824	50092	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:48.942480087 CET	50092	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:48.965398073 CET	50092	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:48.973364115 CET	50093	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:49.092658997 CET	12824	50092	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:49.100004911 CET	12824	50093	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:49.100080967 CET	50093	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:49.100588083 CET	50093	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:49.228106976 CET	12824	50093	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:49.228173018 CET	50093	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:49.355477095 CET	12824	50093	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:49.387295961 CET	50093	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:49.514708042 CET	12824	50093	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:50.425286055 CET	12824	50093	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:50.425367117 CET	50093	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:50.449372053 CET	50093	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:50.450114012 CET	50094	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:50.576632023 CET	12824	50093	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:50.577827930 CET	12824	50094	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:50.577919960 CET	50094	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:50.578686953 CET	50094	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:50.705713987 CET	12824	50094	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:50.705801010 CET	50094	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:50.833033085 CET	12824	50094	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:52.308619022 CET	12824	50094	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:52.308712959 CET	50094	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:52.324384928 CET	50094	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:52.325290918 CET	50095	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:52.451710939 CET	12824	50094	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:52.452765942 CET	12824	50095	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:52.452857018 CET	50095	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:52.453488111 CET	50095	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:52.581407070 CET	12824	50095	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:52.581486940 CET	50095	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:52.708915949 CET	12824	50095	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:54.139373064 CET	12824	50095	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:54.139480114 CET	50095	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:54.152519941 CET	50095	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:54.153598070 CET	50096	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:54.281439066 CET	12824	50095	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:54.282001972 CET	12824	50096	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:54.282098055 CET	50096	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:54.282841921 CET	50096	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:54.410201073 CET	12824	50096	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:54.410303116 CET	50096	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:54.531039953 CET	12824	50096	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:55.743213892 CET	12824	50096	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:55.743289948 CET	50096	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:55.761904001 CET	50096	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:55.762820005 CET	50097	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:55.882289886 CET	12824	50096	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:55.883167982 CET	12824	50097	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:55.883249998 CET	50097	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:55.883918047 CET	50097	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:56.005008936 CET	12824	50097	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:56.005070925 CET	50097	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:56.125752926 CET	12824	50097	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:57.291414976 CET	12824	50097	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:57.291620970 CET	50097	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:57.308871031 CET	50097	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:57.309537888 CET	50098	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:57.429341078 CET	12824	50097	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:57.430080891 CET	12824	50098	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:57.430175066 CET	50098	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:57.433065891 CET	50098	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:57.553414106 CET	12824	50098	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:57.553667068 CET	50098	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:57.674401999 CET	12824	50098	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:59.156424999 CET	12824	50098	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:59.156634092 CET	50098	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:59.168160915 CET	50098	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:59.168987989 CET	50099	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:59.288480043 CET	12824	50098	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:59.289427996 CET	12824	50099	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:59.289520025 CET	50099	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:59.291685104 CET	50099	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:59.412029028 CET	12824	50099	18.197.239.5	192.168.2.4
Nov 25, 2024 17:40:59.412106037 CET	50099	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:40:59.532677889 CET	12824	50099	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:00.806189060 CET	12824	50099	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:00.806394100 CET	50099	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:00.825933933 CET	50099	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:00.827712059 CET	50100	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:00.947448015 CET	12824	50099	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:00.949268103 CET	12824	50100	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:00.949584961 CET	50100	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:00.949982882 CET	50100	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:01.070864916 CET	12824	50100	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:01.071043968 CET	50100	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:01.194720984 CET	12824	50100	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:02.406498909 CET	12824	50100	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:02.406755924 CET	50100	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:02.418200016 CET	50100	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:02.418899059 CET	50101	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:02.538717985 CET	12824	50100	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:02.539289951 CET	12824	50101	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:02.539350986 CET	50101	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:02.550162077 CET	50101	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:02.670679092 CET	12824	50101	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:02.670922995 CET	50101	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:02.791506052 CET	12824	50101	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:04.138622999 CET	12824	50101	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:04.138830900 CET	50101	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:04.152571917 CET	50101	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:04.153666973 CET	50102	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:04.273144007 CET	12824	50101	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:04.273956060 CET	12824	50102	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:04.274064064 CET	50102	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:04.274776936 CET	50102	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:04.395170927 CET	12824	50102	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:04.398467064 CET	50102	12824	192.168.2.4	18.197.239.5
Nov 25, 2024 17:41:04.518831015 CET	12824	50102	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:05.951510906 CET	12824	50102	18.197.239.5	192.168.2.4
Nov 25, 2024 17:41:05.951566935 CET	50102	12824	192.168.2.4	18.197.239.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 17:37:05.084919930 CET	54906	53	192.168.2.4	1.1.1.1
Nov 25, 2024 17:37:05.387588024 CET	53	54906	1.1.1.1	192.168.2.4
Nov 25, 2024 17:38:06.819610119 CET	56198	53	192.168.2.4	1.1.1.1
Nov 25, 2024 17:38:07.042567015 CET	53	56198	1.1.1.1	192.168.2.4
Nov 25, 2024 17:39:08.012379885 CET	50926	53	192.168.2.4	1.1.1.1
Nov 25, 2024 17:39:08.246834040 CET	53	50926	1.1.1.1	192.168.2.4
Nov 25, 2024 17:40:08.172646999 CET	52253	53	192.168.2.4	1.1.1.1
Nov 25, 2024 17:40:08.404128075 CET	53	52253	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 17:37:05.084919930 CET	192.168.2.4	1.1.1.1	0xb665	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Nov 25, 2024 17:38:06.819610119 CET	192.168.2.4	1.1.1.1	0xa9e0	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Nov 25, 2024 17:39:08.012379885 CET	192.168.2.4	1.1.1.1	0x8a57	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Nov 25, 2024 17:40:08.172646999 CET	192.168.2.4	1.1.1.1	0xf61b	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 17:37:05.387588024 CET	1.1.1.1	192.168.2.4	0xb665	No error (0)	2.tcp.eu.ngrok.io	3.126.37.18	A (IP address)	IN (0x0001)	false
Nov 25, 2024 17:38:07.042567015 CET	1.1.1.1	192.168.2.4	0xa9e0	No error (0)	2.tcp.eu.ngrok.io	18.156.13.209	A (IP address)	IN (0x0001)	false
Nov 25, 2024 17:39:08.246834040 CET	1.1.1.1	192.168.2.4	0x8a57	No error (0)	2.tcp.eu.ngrok.io	18.192.93.86	A (IP address)	IN (0x0001)	false
Nov 25, 2024 17:40:08.404128075 CET	1.1.1.1	192.168.2.4	0xf61b	No error (0)	2.tcp.eu.ngrok.io	18.197.239.5	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	11:36:58
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\W9UAjNR4L6.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\W9UAjNR4L6.exe"
Imagebase:	0x530000
File size:	93'184 bytes
MD5 hash:	25A598F19FC93ED7ABD222C542270070
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1660962736.0000000000532000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.4124195324.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	11:37:00
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe" "W9UAjNR4L6.exe" ENABLE
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	11:37:00
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	11:37:01
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall delete allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe"
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	11:37:01
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\W9UAjNR4L6.exe" "W9UAjNR4L6.exe" ENABLE
Imagebase:	0x1560000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	5
Start time:	11:37:01
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	11:37:01
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true