Edit tour

Windows Analysis Report
Server.exe

Overview

General Information

Sample name:	Server.exe
Analysis ID:	1575641
MD5:	4df91688458d5a32f5a2bc93b6c81094
SHA1:	43866e87b1cb0e5c7f52b91eeabfb6816698b070
SHA256:	e0e8a7c2ce540f674aea4fb7d880a16021dfd15552897b01bfdfa2d0981b9aed
Tags:	exeNjRATuser-lontze7
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

AI detected suspicious sample

Disables zone checking for all users

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

Server.exe (PID: 7164 cmdline: "C:\Users\user\Desktop\Server.exe" MD5: 4DF91688458D5A32F5A2BC93B6C81094)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Install Dir": "TEMP", "Install Name": "Dllhost.exe", "Startup": "True", "Campaign ID": "HacKed", "Version": "Njrat 0.7 Golden By Hassan Amiri", "Network Seprator": "|Hassan|", "Mutex": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Install Flag": ""}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Server.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Server.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93e0:$a2: SEE_MASK_NOZONECHECKS 0x91f0:$a3: Download ERROR 0x9608:$a4: cmd.exe /c ping 0 -n 2 & del "
Server.exe	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x9608:$x1: cmd.exe /c ping 0 -n 2 & del " 0x9496:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x908a:$x3: www.upload.ee/image/ 0x90e2:$x3: www.upload.ee/image/ 0x913e:$x3: www.upload.ee/image/ 0x8d88:$s1: winmgmts:\\.\root\SecurityCenter2 0x947e:$s2: /Server.exe 0x9212:$s3: Executed As 0x724d:$s5: Stub.exe 0x91f0:$s6: Download ERROR 0x8eae:$s7: shutdown -r -t 00 0x8d4a:$s8: Select * From AntiVirusProduct
Server.exe	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93e0:$reg: SEE_MASK_NOZONECHECKS 0x91cc:$msg: Execute ERROR 0x922c:$msg: Execute ERROR 0x9608:$ping: cmd.exe /c ping 0 -n 2 & del

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7abd:$a1: get_Registry 0x91e0:$a2: SEE_MASK_NOZONECHECKS 0x8ff0:$a3: Download ERROR 0x9408:$a4: cmd.exe /c ping 0 -n 2 & del "
00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x91e0:$reg: SEE_MASK_NOZONECHECKS 0x8fcc:$msg: Execute ERROR 0x902c:$msg: Execute ERROR 0x9408:$ping: cmd.exe /c ping 0 -n 2 & del
00000000.00000002.3714790735.00000000022E1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: Server.exe PID: 7164	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Server.exe.10000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.Server.exe.10000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x7cbd:$a1: get_Registry 0x93e0:$a2: SEE_MASK_NOZONECHECKS 0x91f0:$a3: Download ERROR 0x9608:$a4: cmd.exe /c ping 0 -n 2 & del "
0.0.Server.exe.10000.0.unpack	CN_disclosed_20180208_c	Detects malware from disclosed CN malware set	Florian Roth	0x9608:$x1: cmd.exe /c ping 0 -n 2 & del " 0x9496:$x2: schtasks /create /sc minute /mo 1 /tn Server /tr 0x908a:$x3: www.upload.ee/image/ 0x90e2:$x3: www.upload.ee/image/ 0x913e:$x3: www.upload.ee/image/ 0x8d88:$s1: winmgmts:\\.\root\SecurityCenter2 0x947e:$s2: /Server.exe 0x9212:$s3: Executed As 0x724d:$s5: Stub.exe 0x91f0:$s6: Download ERROR 0x8eae:$s7: shutdown -r -t 00 0x8d4a:$s8: Select * From AntiVirusProduct
0.0.Server.exe.10000.0.unpack	Njrat	detect njRAT in memory	JPCERT/CC Incident Response Group	0x93e0:$reg: SEE_MASK_NOZONECHECKS 0x91cc:$msg: Execute ERROR 0x922c:$msg: Execute ERROR 0x9608:$ping: cmd.exe /c ping 0 -n 2 & del

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T07:38:08.631884+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:33.375237+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:56.567111+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:20.506499+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:44.590410+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:08.647578+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:33.038863+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:56.665559+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:20.965944+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:44.771611+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T07:38:08.631884+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:33.375237+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:56.567111+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:20.506499+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:44.590410+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:08.647578+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:33.038863+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:56.665559+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:20.965944+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:44.771611+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T07:38:13.275807+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:38.382625+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:57.988105+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:08.487036+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:08.852971+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:10.465868+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:10.590975+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:12.219813+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:12.459571+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:12.630038+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:14.312297+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:15.873696+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:17.791381+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:21.708077+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:22.909364+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:23.361523+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:23.721140+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:28.554881+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:44.967345+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:46.888611+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:48.895369+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:49.406346+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:49.531793+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:51.350768+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:51.470852+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:51.590603+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:53.139180+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:55.190098+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:55.309928+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:56.892873+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:57.012766+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:57.203132+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:00.702152+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:01.072838+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:01.210100+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:02.539308+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:02.785267+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:05.537724+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:06.385055+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:09.613666+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:12.644601+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:14.461280+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:14.701789+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:15.085903+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:16.304936+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:17.984294+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:18.104010+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:18.462123+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:20.008951+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:22.047420+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:22.289934+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:22.410374+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:23.531944+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:24.372980+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:25.723883+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:27.310610+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:28.633636+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:29.015143+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:34.960720+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:36.705406+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.105485+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.225370+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.345452+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.465405+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.692412+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:41.500353+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:45.248441+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:50.192647+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:57.508686+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:58.589178+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:58.829005+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:58.949307+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:59.669811+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:00.391154+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:00.635186+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:00.876619+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:01.484477+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:01.604530+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:01.724941+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:02.500627+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.088222+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.208402+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.328469+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.532756+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.652702+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:05.530609+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:09.247961+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:11.051164+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:11.171060+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:11.290844+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:11.594487+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:12.320750+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:12.567414+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:14.966365+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:15.446162+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:17.161903+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:18.483152+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:21.325805+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:21.568688+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:21.694810+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:21.934815+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:22.219421+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:22.339311+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:24.568002+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:24.687945+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:28.083443+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:28.203556+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:30.209554+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:30.508734+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:31.876831+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:31.996679+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:32.356738+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:32.597210+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:32.820471+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:35.228308+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:36.429202+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:38.986288+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:39.403352+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:39.705200+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:40.664964+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:41.864962+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:45.372182+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:45.856591+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:46.100821+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:46.944369+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:47.304370+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:47.904743+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:50.358008+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:51.559230+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:53.002433+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:53.483334+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:54.083470+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:54.203461+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:54.323458+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:54.496124+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:55.696126+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:57.098374+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:57.219283+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:59.749732+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:01.008946+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:01.536768+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:02.266972+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:02.507362+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:03.107496+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T07:38:08.751690+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:33.523181+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:56.686913+0100	2825563	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP

ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T07:38:08.751690+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:33.523181+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:56.686913+0100	2838486	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP

ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T07:38:08.631884+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:33.375237+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:56.567111+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:20.506499+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:44.590410+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:08.647578+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:33.038863+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:56.665559+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:20.965944+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:44.771611+0100	2830459	1	Malware Command and Control Activity Detected	192.168.2.7	49978	82.193.104.21	5137	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Server.exe

Avira: detected

Found malware configuration

Source: 0.0.Server.exe.10000.0.unpack

Malware Configuration Extractor: Njrat {"Install Dir": "TEMP", "Install Name": "Dllhost.exe", "Startup": "True", "Campaign ID": "HacKed", "Version": "Njrat 0.7 Golden By Hassan Amiri", "Network Seprator": "|Hassan|", "Mutex": "Software\\Microsoft\\Windows\\CurrentVersion\\Run", "Install Flag": ""}

Multi AV Scanner detection for submitted file

Source: Server.exe

ReversingLabs: Detection: 86%

Yara detected Njrat

Source: Yara match	File source: Server.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3714790735.00000000022E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server.exe PID: 7164, type: MEMORYSTR

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: Server.exe

Joe Sandbox ML: detected

Source: Server.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Server.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49701 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49701 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49701 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.7:49701 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.7:49701 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49701 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49754 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49754 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49754 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.7:49754 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.7:49754 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49754 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49811 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49811 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49811 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825563 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf) : 192.168.2.7:49811 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2838486 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf) : 192.168.2.7:49811 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49811 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49861 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49861 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49861 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49861 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49912 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49912 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49912 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49912 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49963 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49963 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49963 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49963 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49975 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49975 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49975 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49976 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49975 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49976 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49976 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49976 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49977 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49977 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49977 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49977 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.7:49978 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.7:49978 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2830459 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan) : 192.168.2.7:49978 -> 82.193.104.21:5137
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.7:49978 -> 82.193.104.21:5137

Source: global traffic

TCP traffic: 192.168.2.7:49701 -> 82.193.104.21:5137

Source: Joe Sandbox View

ASN Name: ASN-ASIPNUA ASN-ASIPNUA

Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21
Source: unknown	TCP traffic detected without corresponding DNS query: 82.193.104.21

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: Server.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3714790735.00000000022E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server.exe PID: 7164, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: Server.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: Server.exe, type: SAMPLE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: Server.exe, type: SAMPLE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect njRAT in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\Server.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_0097A7A0	0_2_0097A7A0
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_0097F4D0	0_2_0097F4D0
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_0097D5F0	0_2_0097D5F0
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_0097E340	0_2_0097E340
Source: C:\Users\user\Desktop\Server.exe	Code function: 0_2_0097A794	0_2_0097A794

Source: Server.exe, 00000000.00000002.3712981272.000000000040E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Server.exe
Source: Server.exe, 00000000.00000002.3712934227.00000000001B8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Server.exe

Source: Server.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Server.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: Server.exe, type: SAMPLE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Server.exe, type: SAMPLE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: CN_disclosed_20180208_c date = 2018-02-08, hash1 = 17475d25d40c877284e73890a9dd55fccedc6a5a071c351a8c342c8ef7f9cea7, author = Florian Roth, description = Detects malware from disclosed CN malware set, reference = https://twitter.com/cyberintproject/status/961714165550342146, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan
Source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Njrat hash1 = d5f63213ce11798879520b0e9b0d1b68d55f7727758ec8c120e370699a41379d, author = JPCERT/CC Incident Response Group, description = detect njRAT in memory, rule_usage = memory scan

Source: classification engine

Classification label: mal100.phis.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\Server.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Server.exe	Mutant created: \Sessions\1\BaseNamedObjects\Windows Update

Source: Server.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Server.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Server.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Server.exe

ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\Server.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Section loaded: sxs.dll	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Server.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Server.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: Server.exe, OK.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 22E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 42E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 5DB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Memory allocated: 4E60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe	Window / User API: threadDelayed 828	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Window / User API: threadDelayed 5515	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Window / User API: threadDelayed 2949	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Window / User API: foregroundWindowGot 768	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Window / User API: foregroundWindowGot 765	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe TID: 5968	Thread sleep count: 828 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 5968	Thread sleep time: -82800s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 5260	Thread sleep count: 5515 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 5260	Thread sleep time: -5515000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 5260	Thread sleep count: 2949 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe TID: 5260	Thread sleep time: -2949000s >= -30000s	Jump to behavior

Source: Server.exe, 00000000.00000002.3712981272.00000000004C3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF

Source: C:\Users\user\Desktop\Server.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Server.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/09 \| 23:12:07 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:44:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:59:39 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:50:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 13:11:52 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 18:40:05 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:43:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/29 \| 21:27:56 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:43:29 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 20:46:38 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:28:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:35:25 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:06:07 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 05:38:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 17:17:24 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 19:09:11 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:55:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/06 \| 01:49:50 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 23:55:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 16:07:16 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:49:47 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:28:56 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/27 \| 17:14:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:03:07 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:29:13 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 18:01:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:12:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/20 \| 23:10:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 20:46:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/25 \| 07:38:54 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 18:27:08 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/27 \| 16:48:44 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:19:18 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 10:14:15 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:33:37 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 07:40:09 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 17:25:52 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 20:42:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:43:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 20:52:10 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:05:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 20:26:44 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 01:38:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:28:52 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:31:56 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:47:53 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 13:20:54 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 06:41:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:57:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 00:46:37 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 18:26:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:30:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 19:56:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 01:18:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 13:59:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 23:00:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 02:47:59 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/29 \| 21:31:44 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/19 \| 03:18:39 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 09:43:48 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:36:40 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 14:02:19 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:45:37 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/14 \| 11:32:46 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 13:59:44 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 06:13:55 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 08:15:03 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:11:25 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:42:38 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:24:46 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:24:32 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 03:23:57 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 11:44:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:06:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:45:56 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:08:06 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 07:13:17 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 18:29:07 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 19:16:24 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 13:41:17 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/06 \| 01:48:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/19 \| 03:34:46 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:31:10 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:42:09 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:26:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 20:49:08 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:58:40 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 10:53:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/14 \| 11:38:17 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:07:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 01:03:27 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:32:13 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 17:47:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:25:38 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:18:02 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 11:45:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 02:58:48 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 06:57:57 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:37:19 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:33:40 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/29 \| 20:39:09 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 14:53:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 19:23:34 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/06 \| 01:36:01 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:20:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:42:22 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 03:35:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:21:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:12:09 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 17:46:52 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 05:50:19 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:59:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 21:10:23 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 17:57:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 02:09:35 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/03 \| 06:18:34 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 03:50:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:57:13 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 19:25:29 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 19:03:03 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/14 \| 11:06:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:25:22 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:07:42 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 11:40:50 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 23:13:22 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:41:16 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 03:28:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 01:41:59 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/14 \| 11:16:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:33:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/06 \| 01:46:36 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 19:33:24 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:45:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:59:03 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:33:37 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/06 \| 01:49:13 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:53:25 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:03:50 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:54:22 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 10:51:09 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/19 \| 03:35:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 07:04:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 12:09:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:36:18 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 00:56:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 19:34:23 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:45:13 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 04:10:02 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:50:49 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:52:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:52:04 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 01:18:01 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:42:45 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 05:44:39 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:44:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/07 \| 21:21:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 08:03:11 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 18:28:42 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 17:31:47 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/27 \| 10:59:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 18:09:50 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/14 \| 11:27:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:43:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 16:02:59 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 23:41:28 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:51:41 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:57:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 06:37:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 23:43:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 02:25:05 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 13:50:59 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 02:31:16 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:36:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 19:15:55 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 01:41:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:25:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 18:23:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:05:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:37:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 13:18:53 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:11:25 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:56:59 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 13:28:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 07:40:13 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:30:18 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 00:13:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:31:11 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 15:10:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 20:09:44 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:56:45 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 08:40:42 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:39:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 19:42:29 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:04:34 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 01:13:53 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:13:57 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:59:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:28:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 01:26:35 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 03:51:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 17:54:27 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:56:08 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 14:10:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:32:44 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:37:57 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 11:49:12 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:52:34 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:05:07 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 00:59:57 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:42:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 18:21:04 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 03:30:04 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 11:48:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 01:51:55 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 11:54:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:51:40 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/06 \| 02:00:49 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:09:42 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 15:17:42 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:14:17 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:03:04 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:07:46 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:38:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:37:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:31:54 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:43:37 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:43:09 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 15:37:36 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:31:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 11:15:37 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 15:06:53 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/29 \| 20:46:11 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:26:44 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 15:53:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 06:33:19 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:33:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:22:08 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:23:44 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 13:46:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:39:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 05:23:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 07:41:06 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:56:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/25 \| 07:34:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:57:16 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:24:37 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/20 \| 23:08:17 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:36:35 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:10:08 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 05:19:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 01:21:35 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:15:11 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 11:10:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:58:03 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/09 \| 23:16:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:54:57 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 08:47:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 03:26:16 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 17:45:22 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 07:07:44 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 11:30:01 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:35:34 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 17:01:29 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 08:28:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 13:08:54 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 19:40:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 03:09:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/14 \| 10:48:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 05:37:35 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 11:32:15 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 15:30:10 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 19:13:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 02:28:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:34:34 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:53:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:50:15 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:59:05 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:56:29 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:47:52 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:35:49 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 03:18:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 01:26:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 18:29:13 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:18:47 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:02:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:46:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 11:59:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 15:39:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/19 \| 03:05:27 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 07:29:39 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:57:56 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:44:29 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/27 \| 17:00:34 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 19:12:24 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 08:09:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:24:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/05 \| 10:23:42 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:24:15 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 15:15:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:03:35 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:47:45 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:04:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 10:08:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:38:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 03:17:11 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 18:25:22 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 12:12:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:52:05 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 03:11:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 13:54:29 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:59:55 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:49:54 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:30:39 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/09 \| 23:21:10 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/20 \| 23:02:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 02:59:19 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 03:26:53 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 07:16:04 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 02:05:40 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 14:56:08 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 11:14:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 05:32:48 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:04:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 19:35:47 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 18:36:54 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 19:35:16 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:28:38 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:57:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 11:58:39 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 08:13:46 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 13:31:09 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 03:36:34 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 08:14:17 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:40:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 19:08:57 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:55:19 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:39:04 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:01:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/06 \| 01:51:54 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 17:50:27 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 19:50:23 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 18:04:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 08:12:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:44:46 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 01:49:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/18 \| 19:36:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 10:35:00 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:37:27 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 18:56:27 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/20 \| 23:02:09 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:53:42 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/20 \| 22:59:22 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:03:42 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:51:08 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 01:04:57 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002354000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 06:23:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:04:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:40:15 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 19:12:45 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 04:02:52 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:47:21 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:05:06 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:20:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:00:10 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 04:33:49 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:49:22 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:49:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 06:28:38 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/29 \| 21:22:02 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 03:05:48 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:50:18 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:15:55 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.00000000023B5000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 06:12:25 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 02:58:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:06:02 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:33:55 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:23:59 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:35:56 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 13:02:24 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 07:37:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 15:15:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 15:26:47 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/12 \| 03:00:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 17:33:25 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:59:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:19:55 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 23:33:16 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/19 \| 03:41:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:22:35 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:09:05 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 15:13:49 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 06:51:49 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 10:19:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:02:50 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:57:03 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:43:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 12:53:54 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 00:45:07 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:48:19 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/01 \| 14:18:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:56:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:11:09 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 20:27:15 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 12:10:59 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 17:34:57 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:16:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:50:53 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 06:21:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:08:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 18:52:18 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 06:32:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 19:59:47 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 18:34:54 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 15:41:23 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 02:39:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:18:19 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/29 \| 21:28:27 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 19:08:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 20:40:50 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 17:16:03 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 01:33:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:44:23 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 13:50:15 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/29 \| 21:12:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/03 \| 06:51:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 01:43:35 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 18:59:41 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 07:37:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:59:53 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 15:13:27 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/09 \| 23:06:18 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/14 \| 11:19:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:22:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 12:37:44 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 01:12:52 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 22:34:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 01:25:59 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/08 \| 05:54:27 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 19:03:58 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 17:15:23 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:47:46 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 07:12:46 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/14 \| 07:42:51 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 13:51:23 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:49:01 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 17:19:02 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:39:42 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 21:17:02 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 18:40:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 02:28:18 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 11:04:26 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/03 \| 14:00:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/03 \| 06:33:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/12 \| 06:12:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:15:25 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 10:01:40 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 12:48:20 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:04:09 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 20:19:33 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 20:28:45 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:58:52 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 02:04:40 - Program Manager
Source: Server.exe, 00000000.00000002.3714790735.0000000002608000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3714790735.00000000023FF000.00000004.00000800.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 16:45:00 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/29 \| 21:32:15 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 01:04:11 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/30 \| 03:44:11 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:17:46 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 07:25:15 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 20:20:14 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 02:42:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 23:06:40 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/29 \| 21:29:57 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 17:26:23 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/21 \| 07:15:56 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 19:33:53 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/01 \| 08:18:19 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/10 \| 00:39:18 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 14:53:28 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 02:24:34 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/27 \| 16:50:31 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:11:47 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/23 \| 03:27:17 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/03 \| 21:56:04 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 22:30:47 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 23:21:06 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/25 \| 19:07:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/28 \| 00:13:48 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 18:49:44 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/23 \| 13:17:24 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/23 \| 02:38:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/25 \| 10:23:03 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/14 \| 11:07:12 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/01/16 \| 15:27:39 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/27 \| 23:46:43 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/16 \| 12:23:32 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 24/12/16 \| 17:22:21 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/07 \| 16:45:30 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/18 \| 19:10:22 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/03/06 \| 01:48:37 - Program Manager
Source: Server.exe, 00000000.00000002.3716698262.00000000032E9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 25/02/01 \| 02:12:15 - Program Manager

Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\Users\user\Desktop\Server.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Server.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disables zone checking for all users

Source: C:\Users\user\Desktop\Server.exe

Registry value created: HKEY_CURRENT_USER\Environment SEE_MASK_NOZONECHECKS

Jump to behavior

Source: Server.exe, 00000000.00000002.3721688913.0000000005965000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3712981272.00000000004D2000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3712981272.0000000000498000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3712981272.0000000000443000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3712981272.0000000000482000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3721688913.0000000005970000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3721591890.000000000593A000.00000004.00000020.00020000.00000000.sdmp, Server.exe, 00000000.00000002.3721383169.0000000005910000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Desktop\Server.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: Server.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3714790735.00000000022E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server.exe PID: 7164, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: Server.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Server.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3714790735.00000000022E1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Server.exe PID: 7164, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	2 Virtualization/Sandbox Evasion	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Server.exe	87%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
Server.exe	100%	Avira	TR/Dropper.Gen7
Server.exe	100%	Joe Sandbox ML

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
82.193.104.21	unknown	Ukraine		25521	ASN-ASIPNUA	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575641
Start date and time:	2024-12-16 07:37:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Server.exe
Detection:	MAL
Classification:	mal100.phis.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 8 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.245.163.56
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Server.exe

Simulations

Behavior and APIs

Time	Type	Description
01:38:07	API Interceptor	477073x Sleep call for process: Server.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-ASIPNUA	na.elf	Get hash	malicious	Mirai	Browse	185.223.113.165
	counter.exe	Get hash	malicious	Bdaejec	Browse	82.193.122.190
	addvXQnjp3.elf	Get hash	malicious	Unknown	Browse	185.223.113.171
	7JE8iEYd60.elf	Get hash	malicious	Mirai	Browse	185.223.113.169
	XoYKtA4XeB	Get hash	malicious	Unknown	Browse	185.223.113.153

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.605818131055474
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Server.exe
File size:	44'032 bytes
MD5:	4df91688458d5a32f5a2bc93b6c81094
SHA1:	43866e87b1cb0e5c7f52b91eeabfb6816698b070
SHA256:	e0e8a7c2ce540f674aea4fb7d880a16021dfd15552897b01bfdfa2d0981b9aed
SHA512:	a9e28b1cea690e7774d6f5a102237cad0882615e066f6dbe0e2b9da8dbd3ae2a29e63ea73bd083409771108ce1d2cb1845271e0fe4a9a71f9dcb46bec62da491
SSDEEP:	384:fZy5cYFgpWoy7ythdq+sEJ+3AkhzYIij+ZsNO3PlpJKkkjh/TzF7pWn3mgreT0pO:hWWol7UhdZIwuuXQ/oeC+L
TLSH:	7B13D88CB794E174D5FF8BF1B4A2B2890B71A017A806930F99F154D94BB3EC09611EE7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......^............................~.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40c37e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5EC00D0E [Sat May 16 15:55:58 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc330	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe000	0x400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa384	0xa400	9fc73a0d9553a4bc03b1503322dcacb8	False	0.4201124237804878	data	5.698916113443971	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xe000	0x400	0x400	e6bddab8cfc5a0b85c6b2404ef045c60	False	0.3017578125	data	3.5160679793070893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	c9dbc1f25e59a7d5a1be488346eca853	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xe058	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T07:38:08.631884+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:08.631884+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:08.631884+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:08.751690+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:08.751690+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:13.275807+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49701	82.193.104.21	5137	TCP
2024-12-16T07:38:33.375237+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:33.375237+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:33.375237+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:33.523181+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:33.523181+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:38.382625+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49754	82.193.104.21	5137	TCP
2024-12-16T07:38:56.567111+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:38:56.567111+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:38:56.567111+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:38:56.686913+0100	2825563	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (inf)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:38:56.686913+0100	2838486	ETPRO MALWARE njRAT/Bladabindi Variant CnC Activity (inf)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:38:57.988105+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:08.487036+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:08.852971+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:10.465868+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:10.590975+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:12.219813+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:12.459571+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:12.630038+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:14.312297+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:15.873696+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:17.791381+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49811	82.193.104.21	5137	TCP
2024-12-16T07:39:20.506499+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:20.506499+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:20.506499+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:21.708077+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:22.909364+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:23.361523+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:23.721140+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:28.554881+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49861	82.193.104.21	5137	TCP
2024-12-16T07:39:44.590410+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:44.590410+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:44.590410+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:44.967345+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:46.888611+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:48.895369+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:49.406346+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:49.531793+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:51.350768+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:51.470852+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:51.590603+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:53.139180+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:55.190098+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:55.309928+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:56.892873+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:57.012766+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:39:57.203132+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:00.702152+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:01.072838+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:01.210100+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:02.539308+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:02.785267+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:05.537724+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:06.385055+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49912	82.193.104.21	5137	TCP
2024-12-16T07:40:08.647578+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:08.647578+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:08.647578+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:09.613666+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:12.644601+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:14.461280+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:14.701789+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:15.085903+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:16.304936+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:17.984294+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:18.104010+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:18.462123+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:20.008951+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:22.047420+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:22.289934+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:22.410374+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:23.531944+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:24.372980+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:25.723883+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:27.310610+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:28.633636+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:29.015143+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49963	82.193.104.21	5137	TCP
2024-12-16T07:40:33.038863+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:33.038863+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:33.038863+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:34.960720+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:36.705406+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.105485+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.225370+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.345452+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.465405+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:39.692412+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:41.500353+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:45.248441+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:50.192647+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49975	82.193.104.21	5137	TCP
2024-12-16T07:40:56.665559+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:56.665559+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:56.665559+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:57.508686+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:58.589178+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:58.829005+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:58.949307+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:40:59.669811+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:00.391154+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:00.635186+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:00.876619+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:01.484477+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:01.604530+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:01.724941+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:02.500627+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.088222+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.208402+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.328469+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.532756+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:03.652702+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:05.530609+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:09.247961+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:11.051164+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:11.171060+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:11.290844+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:11.594487+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:12.320750+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:12.567414+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:14.966365+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:15.446162+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:17.161903+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:18.483152+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49976	82.193.104.21	5137	TCP
2024-12-16T07:41:20.965944+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:20.965944+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:20.965944+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:21.325805+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:21.568688+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:21.694810+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:21.934815+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:22.219421+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:22.339311+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:24.568002+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:24.687945+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:28.083443+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:28.203556+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:30.209554+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:30.508734+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:31.876831+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:31.996679+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:32.356738+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:32.597210+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:32.820471+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:35.228308+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:36.429202+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:38.986288+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:39.403352+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:39.705200+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:40.664964+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:41.864962+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49977	82.193.104.21	5137	TCP
2024-12-16T07:41:44.771611+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:44.771611+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:44.771611+0100	2830459	ETPRO MALWARE njRAT/Bladabindi Variant CnC Checkin (Hassan)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:45.372182+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:45.856591+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:46.100821+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:46.944369+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:47.304370+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:47.904743+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:50.358008+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:51.559230+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:53.002433+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:53.483334+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:54.083470+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:54.203461+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:54.323458+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:54.496124+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:55.696126+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:57.098374+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:57.219283+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:41:59.749732+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:01.008946+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:01.536768+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:02.266972+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:02.507362+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP
2024-12-16T07:42:03.107496+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.7	49978	82.193.104.21	5137	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 07:38:08.095036030 CET	49701	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:08.214771032 CET	5137	49701	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:08.214850903 CET	49701	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:08.631884098 CET	49701	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:08.751600981 CET	5137	49701	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:08.751689911 CET	49701	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:08.871448040 CET	5137	49701	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:13.275806904 CET	49701	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:13.395606041 CET	5137	49701	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:30.141547918 CET	5137	49701	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:30.144583941 CET	49701	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:32.149512053 CET	49701	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:32.153631926 CET	49754	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:32.430818081 CET	5137	49701	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:32.430830002 CET	5137	49754	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:32.431036949 CET	49754	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:33.375236988 CET	49754	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:33.523128986 CET	5137	49754	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:33.523180962 CET	49754	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:33.644794941 CET	5137	49754	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:38.382625103 CET	49754	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:38.502319098 CET	5137	49754	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:54.315499067 CET	5137	49754	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:54.315610886 CET	49754	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:56.319868088 CET	49754	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:56.320585012 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:56.439636946 CET	5137	49754	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:56.440316916 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:56.440412045 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:56.567111015 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:56.686825991 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:56.686913013 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:56.806648016 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:38:57.988105059 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:38:58.108113050 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:08.487035990 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:08.606812000 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:08.852971077 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:08.972614050 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:10.465867996 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:10.585544109 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:10.590975046 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:10.710675955 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:12.219813108 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:12.339653015 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:12.339723110 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:12.459460020 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:12.459570885 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:12.579307079 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:12.630038023 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:12.749936104 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:12.750016928 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:12.869792938 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:12.869951010 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:12.991763115 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:12.991921902 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:13.112046957 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:13.112118006 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:13.231861115 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:13.231980085 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:13.351841927 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:13.351927042 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:13.471752882 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:13.471853018 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:13.591597080 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:13.591780901 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:13.711543083 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:13.711674929 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:13.831578970 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:13.831778049 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:13.951648951 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:13.951782942 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:14.071664095 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:14.071736097 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:14.191777945 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:14.191854000 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:14.311901093 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:14.312297106 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:14.432085991 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:15.873696089 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:15.993369102 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:15.993436098 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:16.113143921 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:16.113306999 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:16.232968092 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:16.233079910 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:16.352907896 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:16.353025913 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:16.472737074 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:16.472822905 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:16.592531919 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:16.592662096 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:16.712446928 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:16.712591887 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:16.832304955 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:16.832489014 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:16.952235937 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:16.952313900 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:17.072086096 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:17.072204113 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:17.191896915 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:17.192121029 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:17.311917067 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:17.312026978 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:17.431727886 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:17.431837082 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:17.551569939 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:17.551640987 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:17.671416044 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:17.671494007 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:17.791327000 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:17.791380882 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:17.911135912 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:17.911236048 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:18.030988932 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:18.348098040 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:18.348182917 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:20.351418972 CET	49811	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:20.351880074 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:20.471209049 CET	5137	49811	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:20.471518993 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:20.471621990 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:20.506499052 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:20.626354933 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:20.626514912 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:20.746323109 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:20.746423960 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:20.866189003 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:20.866378069 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:20.987066984 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:20.987198114 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:21.107196093 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:21.107270002 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:21.227036953 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:21.227112055 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:21.348167896 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:21.348262072 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:21.468014002 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:21.468172073 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:21.587847948 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:21.587979078 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:21.707966089 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:21.708076954 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:21.827789068 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:22.909363985 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:23.029000044 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:23.361522913 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:23.481245041 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:23.481369972 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:23.601088047 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:23.601222992 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:23.721002102 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:23.721139908 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:23.841031075 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:23.841198921 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:23.961064100 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:23.961143970 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:24.080986023 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:24.081073046 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:24.202528954 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:24.204720020 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:24.324703932 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:24.326776981 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:24.447266102 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:24.447520018 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:24.567328930 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:24.567403078 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:24.687134981 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:24.687196970 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:24.807087898 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:24.808680058 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:24.928345919 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:24.928817987 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:25.048625946 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:25.052774906 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:25.172590017 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:25.172700882 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:25.292480946 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:25.292599916 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:25.412492990 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:25.412585974 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:25.532629013 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:25.532771111 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:25.695385933 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:25.695593119 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:25.899883986 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:25.900022030 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:26.019978046 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:26.020181894 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:26.140120029 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:26.140235901 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:26.260027885 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:26.260119915 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:26.379787922 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:26.379858971 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:26.499661922 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:26.499840975 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:26.619817972 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:26.619950056 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:26.739972115 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:26.740354061 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:26.860256910 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:26.860379934 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:26.980103016 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:26.980174065 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:27.100270987 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:27.100411892 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:27.220546961 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:27.220715046 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:27.340563059 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:27.340749979 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:27.583298922 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:27.583384991 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:27.827358961 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:27.827447891 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:28.067282915 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:28.067400932 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:28.307352066 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:28.308722019 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:28.548582077 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:28.551278114 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:28.554881096 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:28.791306973 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:28.795841932 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:29.043498993 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:29.044718027 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:29.291539907 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:29.291676998 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:29.539371967 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:29.539556026 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:29.783373117 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:29.783581018 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:30.027342081 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:30.027484894 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:30.271408081 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:30.271531105 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:30.519407988 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:30.519571066 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:30.767304897 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:30.767416954 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:31.007347107 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:31.007481098 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:31.251413107 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:31.251514912 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:31.495425940 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:31.495563030 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:31.739229918 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:31.739335060 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:31.979260921 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:31.979355097 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:32.219343901 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:32.219418049 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:32.459332943 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:32.459422112 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:32.702636957 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:32.702744007 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:32.943304062 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:32.943454981 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:33.183382034 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:33.183485031 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:33.424041033 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:33.424218893 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:33.667329073 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:33.667457104 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:33.907361031 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:33.907438993 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:34.147341967 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:34.147578001 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:34.391293049 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:34.391370058 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:34.635235071 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:34.638775110 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:34.907797098 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:34.910999060 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:35.151273012 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:35.151407957 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:35.391211987 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:35.391330957 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:35.635327101 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:35.635432005 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:35.875236988 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:35.875360966 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:36.123384953 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:36.123537064 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:36.367407084 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:36.367558002 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:36.611289978 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:36.611411095 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:36.851305008 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:36.851406097 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:37.091301918 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:37.091399908 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:37.335266113 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:37.335369110 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:37.575274944 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:37.575401068 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:37.815237999 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:37.815308094 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:38.055260897 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:38.055340052 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:38.295794964 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:38.295985937 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:38.539299011 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:38.540749073 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:38.783389091 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:38.784727097 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:39.027381897 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:39.028711081 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:39.271259069 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:39.271358967 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:39.511280060 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:39.511395931 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:39.751298904 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:39.751389980 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:39.991292953 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:39.991458893 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:40.235289097 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:40.235358000 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:40.475320101 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:40.475405931 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:40.715383053 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:40.715492010 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:40.955318928 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:40.955406904 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:41.195339918 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:41.195477009 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:41.439311028 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:41.439485073 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:41.679287910 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:41.679358006 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:41.919303894 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:41.919414997 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:42.163356066 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:42.163485050 CET	49861	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:42.379625082 CET	5137	49861	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:44.383210897 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:44.502856016 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:44.502974033 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:44.590409994 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:44.710062027 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:44.710311890 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:44.829974890 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:44.967344999 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:45.087219000 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:45.087341070 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:45.207012892 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:45.207230091 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:45.326994896 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:45.327099085 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:45.446726084 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:45.446789980 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:45.566478014 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:45.566593885 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:45.686295986 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:45.686387062 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:45.806178093 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:45.806236982 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:45.925971031 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:45.926136971 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:46.045845985 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:46.045937061 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:46.165682077 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:46.167619944 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:46.287434101 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:46.287503958 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:46.407237053 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:46.408808947 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:46.528533936 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:46.528683901 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:46.648396969 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:46.648499012 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:46.768326044 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:46.768610001 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:46.888431072 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:46.888611078 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:47.008441925 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:47.008502960 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:47.128233910 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:47.128782034 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:47.248528957 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:47.248658895 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:47.368478060 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:47.368614912 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:47.488384008 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:47.488507032 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:47.608685017 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:47.608839989 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:47.728807926 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:47.728993893 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:47.848838091 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:47.848963976 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:47.968966961 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:47.969157934 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:48.088934898 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:48.895369053 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:49.015085936 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:49.406346083 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:49.526943922 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:49.531793118 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:49.651547909 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:49.651695013 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:49.771450043 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:49.771502972 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:49.891356945 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:49.891609907 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:50.011360884 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:50.011503935 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:50.131222010 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:50.131454945 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:50.251394033 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:50.254791975 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:50.374880075 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:50.374994993 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:50.495599985 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:50.499335051 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:50.619144917 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:50.623204947 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:50.742902994 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:50.743199110 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:50.862890959 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:50.866812944 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:50.986500978 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:50.987335920 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:51.107199907 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:51.110991955 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:51.230747938 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:51.230809927 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:51.350595951 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:51.350768089 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:51.470525026 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:51.470851898 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:51.590508938 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:51.590603113 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:51.710325003 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:53.139179945 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:53.259025097 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:53.259330034 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:53.379146099 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:53.379213095 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:53.499490023 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:53.499636889 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:53.619415045 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:53.619637012 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:53.739372969 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:53.739551067 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:53.859350920 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:53.859555006 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:53.980175018 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:53.980325937 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:54.100265980 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:54.100400925 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:54.220129013 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:54.220181942 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:54.339979887 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:54.340179920 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:54.460361004 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:54.460489988 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:54.580418110 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:54.580488920 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:54.700299025 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:54.700382948 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:54.820121050 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:54.820218086 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:54.939977884 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:54.940526009 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:55.060271025 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:55.060323000 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:55.180135965 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:55.190098047 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:55.309777021 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:55.309927940 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:55.429918051 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:56.892873049 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:57.012639999 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:57.012765884 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:57.132461071 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:57.203131914 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:57.323421001 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:57.324399948 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:57.444370031 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:57.444729090 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:57.564547062 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:57.564733982 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:57.684988976 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:57.685225010 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:57.804989100 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:57.805187941 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:57.925493956 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:57.925585985 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:58.045418978 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:58.045557022 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:58.165369034 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:58.165492058 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:58.285197020 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:58.285326004 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:58.404969931 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:58.405038118 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:58.525371075 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:58.525616884 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:58.645504951 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:58.645798922 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:58.765515089 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:58.765592098 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:58.885237932 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:58.885451078 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:59.005132914 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:59.005335093 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:59.125540972 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:59.125746965 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:59.245601892 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:59.245685101 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:59.366807938 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:59.366945982 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:59.486943960 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:59.487015963 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:59.606812000 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:59.606894016 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:59.726794958 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:59.726917028 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:39:59.847611904 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:39:59.848817110 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:00.011359930 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:00.011523008 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:00.215405941 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:00.216844082 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:00.459379911 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:00.702152014 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:00.821796894 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:00.821938992 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:00.944797993 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:00.948832989 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:01.068645954 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:01.072838068 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:01.192539930 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:01.210099936 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:01.330295086 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:02.539308071 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:02.659372091 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:02.785267115 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:02.905077934 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:02.905252934 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:03.025378942 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:03.025599003 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:03.147233009 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:03.147382021 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:03.267083883 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:03.268748999 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:03.388479948 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:03.388721943 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:03.508388996 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:03.508609056 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:03.628516912 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:03.628848076 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:03.748603106 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:03.752780914 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:03.872602940 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:03.875076056 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:03.995383024 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:03.999115944 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:04.119276047 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:04.119349957 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:04.239368916 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:04.240531921 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:04.360186100 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:04.360326052 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:04.480001926 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:04.480200052 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:04.600418091 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:04.600595951 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:04.767935991 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:04.768023968 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:04.971577883 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:05.537724018 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:05.659061909 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:06.385055065 CET	49912	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:06.398571014 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:06.504843950 CET	5137	49912	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:08.414642096 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:08.535896063 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:08.535963058 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:08.647578001 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:08.767431974 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:08.767496109 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:08.887377024 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:08.887480974 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:09.007276058 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:09.007421970 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:09.127265930 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:09.127422094 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:09.247170925 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:09.250767946 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:09.370901108 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:09.372773886 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:09.492990971 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:09.493066072 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:09.613502026 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:09.613666058 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:09.734390974 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:09.734476089 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:09.855252028 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:09.855333090 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:09.976039886 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:09.976784945 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:10.096803904 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:10.100778103 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:10.222903013 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:10.222964048 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:10.342647076 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:10.342734098 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:10.462865114 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:10.462941885 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:10.583074093 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:10.583215952 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:10.703531027 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:10.703743935 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:10.829634905 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:10.829706907 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:10.949666023 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:10.949812889 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:11.069765091 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:11.069899082 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:11.190881014 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:11.191067934 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:11.310911894 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:11.310991049 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:11.430778027 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:11.430852890 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:11.559376001 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:11.559497118 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:11.680481911 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:11.680571079 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:11.802766085 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:11.802889109 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:11.922836065 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:11.922969103 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:12.042927027 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:12.043055058 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:12.162950993 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:12.163115025 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:12.284442902 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:12.284600973 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:12.404381990 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:12.404479027 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:12.524636030 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:12.524703979 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:12.644483089 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:12.644601107 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:12.764539003 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:12.764663935 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:12.884500027 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:12.884738922 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:13.004547119 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:13.004710913 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:13.124536991 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:13.124679089 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:13.244951010 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:13.245043993 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:13.365494013 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:13.365592003 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:13.498424053 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:13.498492956 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:13.618221998 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:13.618452072 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:13.738867998 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:13.738995075 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:13.861212015 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:13.861291885 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:13.981435061 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:13.981561899 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:14.101429939 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:14.101576090 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:14.221338987 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:14.221497059 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:14.341177940 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:14.341372013 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:14.461204052 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:14.461280107 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:14.581763983 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:14.581859112 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:14.701687098 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:14.701788902 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:14.821594000 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:15.085902929 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:15.205713987 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:16.304935932 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:16.424823046 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:16.424935102 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:16.544807911 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:16.544965029 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:16.664782047 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:16.664927006 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:16.784615993 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:16.784734964 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:16.904544115 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:16.904653072 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:17.024491072 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:17.024642944 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:17.144686937 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:17.144859076 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:17.264755011 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:17.264899015 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:17.384690046 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:17.384860039 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:17.504612923 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:17.504780054 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:17.624545097 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:17.624691963 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:17.744524002 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:17.744657993 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:17.864427090 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:17.864506960 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:17.984215021 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:17.984293938 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:18.103948116 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:18.104010105 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:18.223716974 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:18.462122917 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:18.581980944 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:20.008950949 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:20.128768921 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:20.128992081 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:20.248670101 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:20.248728991 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:20.368412971 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:20.368473053 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:20.488156080 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:20.488373995 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:20.608128071 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:20.608207941 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:20.727900982 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:20.728002071 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:20.847661972 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:20.847800970 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:20.967539072 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:20.967789888 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:21.087544918 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:21.087683916 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:21.207355022 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:21.207509995 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:21.327191114 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:21.327277899 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:21.447119951 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:21.447254896 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:21.567264080 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:21.567389011 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:21.687339067 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:21.687480927 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:21.807264090 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:21.807408094 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:21.927237988 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:21.927341938 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:22.047319889 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:22.047420025 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:22.167368889 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:22.289933920 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:22.410218000 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:22.410373926 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:22.530193090 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:23.531944036 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:23.651906967 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:23.652066946 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:23.772250891 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:23.772439003 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:23.892477989 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:23.892621040 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:24.012510061 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:24.012702942 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:24.132759094 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:24.132927895 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:24.252826929 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:24.252902985 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:24.372793913 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:24.372980118 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:24.545867920 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:24.546014071 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:24.720585108 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:24.720772982 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:24.842586994 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:24.842694998 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:24.962661982 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:24.962836027 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:25.082784891 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:25.082942963 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:25.202851057 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:25.202990055 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:25.322896957 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:25.322988033 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:25.443006039 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:25.443094015 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:25.563055992 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:25.563195944 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:25.723692894 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:25.723882914 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:25.927700996 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:27.310610056 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:27.430491924 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:27.430789948 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:27.550820112 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:27.550955057 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:27.670855999 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:27.670943022 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:27.791080952 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:27.791152954 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:27.911073923 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:27.911212921 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:28.031094074 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:28.031233072 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:28.151093960 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:28.151232004 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:28.271126986 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:28.271267891 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:28.391040087 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:28.392764091 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:28.512739897 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:28.513556004 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:28.633562088 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:28.633635998 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:28.754720926 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:28.754803896 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:28.874547005 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:29.015142918 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:29.135587931 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:29.135843992 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:29.255687952 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:29.256781101 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:29.376595020 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:29.376719952 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:29.539747953 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:29.540751934 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:29.743580103 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:29.743706942 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:29.991640091 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:29.991745949 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:30.239474058 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:30.239816904 CET	49963	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:30.430844069 CET	5137	49963	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:32.448755980 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:32.568670034 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:32.568769932 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:33.038862944 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:33.158647060 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:33.158823013 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:33.278669119 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:33.278769016 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:33.398703098 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:33.398780107 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:33.518457890 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:33.518574953 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:33.638314962 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:33.638406038 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:33.758094072 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:33.758197069 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:33.878180981 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:33.878285885 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:33.998172998 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:33.998308897 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:34.118549109 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:34.118685961 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:34.238511086 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:34.238589048 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:34.358495951 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:34.360785007 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:34.480555058 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:34.480686903 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:34.600434065 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:34.600775957 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:34.720554113 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:34.720776081 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:34.840580940 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:34.840667963 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:34.960459948 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:34.960720062 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:35.080522060 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:35.080589056 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:35.200406075 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:36.705405951 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:36.825170040 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:36.825333118 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:36.945611000 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:36.945696115 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:37.065454960 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:37.065548897 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:37.185296059 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:37.185390949 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:37.305869102 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:37.305965900 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:37.425822020 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:37.425908089 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:37.545692921 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:37.545828104 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:37.665590048 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:37.665705919 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:37.785561085 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:37.785692930 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:37.905390024 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:37.905472994 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:38.025244951 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:38.025363922 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:38.145786047 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:38.145911932 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:38.265738964 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:38.265835047 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:38.385598898 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:38.385720015 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:38.505472898 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:38.505548000 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:38.625319958 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:38.625448942 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:38.745121956 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:38.745265961 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:38.865036964 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:38.865272999 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:38.985172987 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:38.985234022 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:39.105408907 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:39.105484962 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:39.225292921 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:39.225369930 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:39.345303059 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:39.345452070 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:39.465334892 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:39.465404987 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:39.585372925 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:39.692411900 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:39.812114954 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:39.812310934 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:39.932084084 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:39.932199001 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:40.052054882 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:40.052156925 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:40.172092915 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:40.172219038 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:40.292192936 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:40.292253017 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:40.412113905 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:40.412195921 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:40.532016993 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:40.532109976 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:40.652029991 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:40.652149916 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:40.771965027 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:40.772133112 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:40.893724918 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:40.893937111 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:41.013772011 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:41.013859034 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:41.133820057 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:41.133949995 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:41.260209084 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:41.260370970 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:41.380297899 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:41.380441904 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:41.500255108 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:41.500353098 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:41.620199919 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:41.620337009 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:41.740166903 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:41.740334988 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:41.860069036 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:41.860222101 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:41.981211901 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:41.981302977 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:42.101265907 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:42.101423025 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:42.221472979 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:42.221595049 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:42.341603994 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:42.341783047 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:42.461744070 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:42.461906910 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:42.582093954 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:42.582171917 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:42.702178001 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:42.702363014 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:42.822249889 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:42.822396040 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:42.942323923 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:42.942482948 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:43.062242031 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:43.062325001 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:43.182070971 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:43.182142019 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:43.301830053 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:43.301955938 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:43.421931028 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:43.422075987 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:43.541944981 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:43.542118073 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:43.662096977 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:43.662224054 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:43.781996965 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:43.782057047 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:43.901890993 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:43.902050972 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:44.021820068 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:44.021939039 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:44.141937971 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:44.142093897 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:44.261846066 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:44.262013912 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:44.382005930 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:44.382074118 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:44.501993895 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:44.502072096 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:44.621896982 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:44.622044086 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:44.742007971 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:44.742150068 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:44.861958027 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:44.862070084 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:44.981911898 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:44.981966972 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:45.101758957 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:45.248440981 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:45.368249893 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:45.368752003 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:45.488562107 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:45.488782883 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:45.608520031 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:45.608741999 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:45.728857040 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:45.728931904 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:45.848854065 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:45.852178097 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:45.972096920 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:45.974973917 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:46.094870090 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:46.095489025 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:46.215250969 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:46.215459108 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:46.335257053 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:46.335372925 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:46.455223083 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:46.455491066 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:46.575325966 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:46.575422049 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:46.695355892 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:46.695583105 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:46.815342903 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:46.815603971 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:46.980199099 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:46.980272055 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:47.183651924 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:47.183959961 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:47.427715063 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:47.427923918 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:47.671530962 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:47.671675920 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:47.915592909 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:47.915867090 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:48.159687042 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:48.159807920 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:48.403593063 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:48.403747082 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:48.651599884 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:48.651715994 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:48.891582012 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:48.891755104 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:49.135639906 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:49.135812998 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:49.383625031 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:49.383734941 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:49.623624086 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:49.623898983 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:49.867706060 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:49.867778063 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:50.192554951 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:50.192646980 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:50.449016094 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:50.449107885 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:50.691548109 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:50.692698002 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:50.939594984 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:50.939685106 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:51.179572105 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:51.179718971 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:51.419557095 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:51.420813084 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:51.663666010 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:51.663754940 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:51.911787987 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:51.911922932 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:52.155638933 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:52.156774044 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:52.399832010 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:52.400077105 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:52.647639990 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:52.647799015 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:52.887554884 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:52.887758970 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:53.131613970 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:53.131782055 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:53.375961065 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:53.376138926 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:53.619642973 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:53.619779110 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:53.867656946 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:53.867821932 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:54.111565113 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:54.111742020 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:54.355555058 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:54.355679989 CET	49975	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:54.480809927 CET	5137	49975	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:56.494406939 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:56.614274979 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:56.616955996 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:56.665559053 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:56.785393953 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:56.787767887 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:56.907615900 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:56.907821894 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:57.027610064 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:57.027755022 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:57.147574902 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:57.147842884 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:57.267996073 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:57.268806934 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:57.388540983 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:57.388669968 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:57.508380890 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:57.508686066 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:57.628563881 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:57.628688097 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:57.748646021 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:57.748789072 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:57.868602991 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:57.868730068 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:57.988537073 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:57.988603115 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:58.108546972 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:58.108702898 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:58.228884935 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:58.229070902 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:58.349081039 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:58.349255085 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:58.469161034 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:58.469259977 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:58.589051008 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:58.589178085 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:58.708966017 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:58.709081888 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:58.828891039 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:58.829005003 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:58.949210882 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:58.949306965 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:59.069152117 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:59.069408894 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:59.189482927 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:59.189620972 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:59.309549093 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:59.309686899 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:59.429591894 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:59.429737091 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:59.549782991 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:59.549931049 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:59.669744015 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:59.669811010 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:59.789834976 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:59.789906979 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:40:59.909816980 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:40:59.909882069 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:00.029710054 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:00.029894114 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:00.151225090 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:00.151372910 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:00.271150112 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:00.271210909 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:00.390942097 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:00.391154051 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:00.511365891 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:00.511498928 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:00.631766081 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:00.635185957 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:00.754960060 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:00.876619101 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:00.996438026 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:00.999341011 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:01.119504929 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:01.121041059 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:01.240984917 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:01.244556904 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:01.364408970 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:01.364545107 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:01.484411001 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:01.484477043 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:01.604449987 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:01.604530096 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:01.724868059 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:01.724941015 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:01.844919920 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:01.845105886 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:01.965152025 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:01.965346098 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:02.085231066 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:02.085443020 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:02.205349922 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:02.205508947 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:02.325579882 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:02.325726032 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:02.445472956 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:02.500627041 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:02.620620966 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:02.620763063 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:02.847436905 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:02.847711086 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:02.968383074 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:02.968436956 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:03.088151932 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:03.088222027 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:03.208096981 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:03.208401918 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:03.328331947 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:03.328469038 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:03.448283911 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:03.532756090 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:03.652604103 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:03.652702093 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:03.772684097 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:05.530608892 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:05.650347948 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:05.650774956 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:05.770632982 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:05.770709038 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:05.890520096 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:05.890902996 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:06.010674000 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:06.011333942 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:06.131115913 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:06.131337881 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:06.251058102 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:06.251332045 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:06.371073961 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:06.371234894 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:06.491111994 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:06.491293907 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:06.611185074 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:06.611361980 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:06.731189013 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:06.731405973 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:06.851171017 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:06.851233006 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:06.971023083 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:06.971225977 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:07.091219902 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:07.091361046 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:07.211077929 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:07.211236954 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:07.331007004 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:07.331106901 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:07.450885057 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:07.450942039 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:07.570677996 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:07.570732117 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:07.690422058 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:09.247961044 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:09.367789984 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:09.367929935 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:09.487732887 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:09.487816095 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:09.607760906 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:09.607933044 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:09.727716923 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:09.727864981 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:09.847626925 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:09.847698927 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:09.967427015 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:09.967536926 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:10.087460995 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:10.087548018 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:10.207966089 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:10.208137035 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:10.327866077 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:10.328047037 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:10.447954893 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:10.448029041 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:10.567806005 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:10.567924023 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:10.687746048 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:10.687882900 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:10.807650089 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:10.807722092 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:10.927400112 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:10.927455902 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:11.051040888 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:11.051163912 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:11.170917988 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:11.171060085 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:11.290775061 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:11.290843964 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:11.410666943 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:11.594486952 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:11.714248896 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:11.714310884 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:11.835005045 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:11.835800886 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:11.955774069 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:11.956780910 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:12.076577902 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:12.076809883 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:12.196700096 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:12.200848103 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:12.320636988 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:12.320749998 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:12.440510988 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:12.440572977 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:12.567363024 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:12.567414045 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:12.687155008 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:12.687266111 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:12.807230949 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:12.807379961 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:12.927264929 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:12.927334070 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:13.047143936 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:13.047230005 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:13.167006016 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:13.167109013 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:13.286942005 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:13.287026882 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:13.406842947 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:13.407044888 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:13.527025938 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:13.527170897 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:13.646976948 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:13.647079945 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:13.766954899 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:13.767091036 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:13.886936903 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:13.887151957 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:14.006901979 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:14.006997108 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:14.126771927 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:14.126894951 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:14.246654987 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:14.246757030 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:14.366897106 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:14.366986990 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:14.486772060 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:14.486865044 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:14.606641054 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:14.606781960 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:14.726528883 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:14.726588011 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:14.846334934 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:14.846453905 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:14.966259003 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:14.966365099 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:15.086131096 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:15.086285114 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:15.206276894 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:15.206413984 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:15.326126099 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:15.326195002 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:15.446091890 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:15.446161985 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:15.631103039 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:17.161902905 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:17.281692982 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:17.281817913 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:17.401957989 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:17.402652979 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:17.522538900 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:17.522770882 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:17.642554045 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:17.642858028 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:17.762650013 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:17.762823105 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:17.882667065 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:17.882997036 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:18.002835989 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:18.002955914 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:18.122909069 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:18.123348951 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:18.243124962 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:18.243253946 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:18.363055944 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:18.363276005 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:18.483071089 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:18.483151913 CET	49976	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:18.521555901 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:18.603236914 CET	5137	49976	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:20.532560110 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:20.652350903 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:20.652457952 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:20.965944052 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:21.085725069 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:21.085788012 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:21.205655098 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:21.205789089 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:21.325650930 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:21.325804949 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:21.445550919 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:21.448862076 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:21.568622112 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:21.568687916 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:21.688492060 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:21.694809914 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:21.814568996 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:21.814973116 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:21.934757948 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:21.934814930 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:22.054575920 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:22.219420910 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:22.339199066 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:22.339310884 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:22.459142923 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:22.460319042 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:22.580368042 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:22.582782984 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:22.702594995 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:22.702826977 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:22.822714090 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:22.823704958 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:22.943582058 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:22.943979979 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:23.063899994 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:24.568001986 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:24.687846899 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:24.687944889 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:24.807698011 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:24.807883024 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:24.928107977 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:24.928441048 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:25.048264027 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:25.048393011 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:25.168270111 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:25.168607950 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:25.288429022 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:25.288533926 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:25.409111977 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:25.409235954 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:25.529078960 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:25.529220104 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:25.649071932 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:25.649178982 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:25.768886089 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:25.768954992 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:25.888644934 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:25.888770103 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:26.009124994 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:26.009196997 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:26.129126072 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:26.129251003 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:26.249051094 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:26.249212027 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:26.369440079 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:26.369561911 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:26.489630938 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:26.490799904 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:26.610533953 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:26.610727072 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:26.730622053 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:28.083442926 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:28.203475952 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:28.203556061 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:28.328027010 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:28.328314066 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:28.527211905 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:28.527461052 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:28.647106886 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:28.647341013 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:28.767091036 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:28.767282009 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:28.887288094 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:28.887442112 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:29.007185936 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:29.007443905 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:29.127284050 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:29.127532005 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:29.247430086 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:29.247560024 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:29.369216919 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:29.369342089 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:29.489355087 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:29.489582062 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:29.609337091 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:29.609505892 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:29.729492903 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:29.729722977 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:29.849564075 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:29.849649906 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:29.969552994 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:29.969626904 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:30.089407921 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:30.089652061 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:30.209477901 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:30.209553957 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:30.329502106 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:30.508733988 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:30.628596067 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:31.876831055 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:31.996562958 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:31.996679068 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:32.116569996 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:32.116673946 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:32.236733913 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:32.236809969 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:32.356653929 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:32.356738091 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:32.476685047 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:32.476855993 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:32.597014904 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:32.597209930 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:32.717215061 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:32.820471048 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:32.940269947 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:32.940890074 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:33.060720921 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:33.063910007 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:33.183795929 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:33.186820984 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:33.306698084 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:33.307230949 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:33.427110910 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:33.427190065 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:33.547054052 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:33.547178030 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:33.666975021 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:33.667135954 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:33.786927938 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:33.787015915 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:33.906771898 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:33.906900883 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:34.026907921 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:34.026966095 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:34.147058964 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:34.147192955 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:34.267111063 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:34.267267942 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:34.387257099 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:34.387569904 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:34.507479906 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:34.507616043 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:34.627604961 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:34.627686024 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:34.747710943 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:34.747869968 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:34.867774963 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:34.867912054 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:34.988086939 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:34.988240004 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:35.108284950 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:35.108367920 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:35.228249073 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:35.228307962 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:35.348143101 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:35.348289967 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:35.468101978 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:35.468251944 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:35.588970900 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:35.589052916 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:35.708903074 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:35.709005117 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:35.828936100 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:35.829001904 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:35.948812962 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:35.948910952 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:36.068821907 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:36.068959951 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:36.188927889 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:36.188991070 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:36.308927059 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:36.308980942 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:36.428906918 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:36.429202080 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:36.549101114 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:36.549355030 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:36.669234037 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:36.669445038 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:36.789531946 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:36.789674997 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:36.909570932 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:36.909677029 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:37.029798985 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:37.029884100 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:37.149764061 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:37.149872065 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:37.269756079 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:37.269968033 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:37.389915943 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:37.390064955 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:37.509922981 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:37.510056973 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:37.629951954 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:37.630044937 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:37.749964952 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:37.750083923 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:37.870059967 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:37.870202065 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:37.990051985 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:38.986288071 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:39.106101990 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:39.403352022 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:39.523367882 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:39.705199957 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:39.825093985 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:39.825319052 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:39.945091009 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:39.945226908 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:40.065063953 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:40.065191031 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:40.185100079 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:40.185175896 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:40.305067062 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:40.305164099 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:40.424999952 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:40.425086975 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:40.544810057 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:40.545051098 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:40.664844990 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:40.664963961 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:40.784864902 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:40.784946918 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:40.904756069 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:40.904884100 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:41.024799109 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:41.024929047 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:41.144893885 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:41.145061016 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:41.264929056 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:41.265089035 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:41.384896994 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:41.384954929 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:41.504796028 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:41.504951000 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:41.624823093 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:41.624933004 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:41.744873047 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:41.745049953 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:41.864875078 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:41.864962101 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:41.984720945 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:42.538203001 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:42.538319111 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:44.570626020 CET	49977	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:44.571068048 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:44.690670967 CET	5137	49977	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:44.691157103 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:44.691258907 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:44.771610975 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:44.891915083 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:44.892106056 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:45.011945009 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:45.012095928 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:45.132337093 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:45.132400036 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:45.252240896 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:45.252383947 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:45.372116089 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:45.372181892 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:45.492119074 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:45.496932983 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:45.616611004 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:45.616966009 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:45.736711979 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:45.736784935 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:45.856534004 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:45.856590986 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:45.976355076 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:45.976423025 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:46.096118927 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:46.100821018 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:46.220730066 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:46.223548889 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:46.343424082 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:46.344847918 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:46.464591980 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:46.464679003 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:46.584429979 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:46.584574938 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:46.704339027 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:46.704395056 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:46.824198961 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:46.824330091 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:46.944137096 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:46.944369078 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:47.064213991 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:47.064325094 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:47.184143066 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:47.184290886 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:47.304255009 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:47.304369926 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:47.424266100 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:47.424405098 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:47.544307947 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:47.544430017 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:47.664602995 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:47.664764881 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:47.784665108 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:47.784843922 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:47.904665947 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:47.904742956 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:48.024532080 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:48.024691105 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:48.195545912 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:48.195681095 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:48.315496922 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:48.315660000 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:48.435441017 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:48.435551882 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:48.555608034 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:48.555749893 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:48.675621033 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:48.675797939 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:48.795690060 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:48.795917034 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:48.915777922 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:48.915899992 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:49.035758972 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:49.036422968 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:49.156301022 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:49.156409025 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:49.276262045 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:49.276388884 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:49.396420002 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:49.396572113 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:49.516602993 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:49.516720057 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:49.636569023 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:49.636761904 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:49.756700039 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:49.756830931 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:49.876813889 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:49.876921892 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:49.996942997 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:49.997064114 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:50.116885900 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:50.117048979 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:50.237052917 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:50.238137960 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:50.357922077 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:50.358007908 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:50.477813959 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:50.477920055 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:50.598078012 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:50.598330975 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:50.718322039 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:50.718477011 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:50.838196039 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:50.838538885 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:50.958389997 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:50.958558083 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:51.078572989 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:51.079145908 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:51.199084997 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:51.199336052 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:51.319196939 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:51.319267035 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:51.439130068 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:51.439202070 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:51.559020996 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:51.559230089 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:51.679264069 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:51.679339886 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:51.799261093 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:51.799453974 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:51.919512987 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:51.919751883 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:52.039616108 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:52.039777994 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:52.159672976 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:52.159898043 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:52.279937029 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:52.280190945 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:52.400099993 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:52.400372028 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:52.520291090 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:52.520466089 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:52.640307903 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:52.640398026 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:52.760215044 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:52.760286093 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:52.880152941 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:52.880211115 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:53.002074957 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:53.002433062 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:53.122483015 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:53.122662067 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:53.242738962 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:53.243603945 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:53.363379955 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:53.363493919 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:53.483237982 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:53.483334064 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:53.603087902 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:53.603224993 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:53.723164082 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:53.723253012 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:53.843425035 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:53.843506098 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:53.963517904 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:53.963577986 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:54.083410978 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:54.083470106 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:54.203402996 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:54.203460932 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:54.323342085 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:54.323457956 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:54.443298101 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:54.496124029 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:54.616018057 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:54.616086006 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:54.736057997 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:54.736197948 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:54.856297016 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:54.856415033 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:54.976417065 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:54.976528883 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:55.096302986 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:55.096432924 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:55.216279030 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:55.216337919 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:55.336235046 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:55.336312056 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:55.456124067 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:55.456187010 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:55.576138020 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:55.576256037 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:55.696067095 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:55.696125984 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:55.815932989 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:57.098373890 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:57.219146967 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:57.219283104 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:57.340739012 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:57.341012955 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:57.460937023 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:57.461061001 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:57.580770969 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:57.580862999 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:57.700628996 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:57.700707912 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:57.820415020 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:57.820492983 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:57.941159010 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:57.941313028 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:58.061141014 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:58.061228991 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:58.181102991 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:58.181197882 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:58.301038027 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:58.301203966 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:58.421576023 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:58.421659946 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:58.542408943 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:58.542629004 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:58.662565947 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:58.662719965 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:58.782697916 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:58.782912016 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:58.903016090 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:58.903175116 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:59.023160934 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:59.023340940 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:59.143495083 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:59.143667936 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:59.263571024 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:41:59.749732018 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:41:59.869627953 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:01.008945942 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:01.128782988 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:01.536767960 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:01.656476021 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:01.658974886 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:01.778709888 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:01.779411077 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:01.899252892 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:01.902873993 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:02.022826910 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:02.023910046 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:02.143764973 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:02.144882917 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:02.264689922 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:02.266972065 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:02.386745930 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:02.387382030 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:02.507249117 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:02.507361889 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:02.627101898 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:02.627269030 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:02.747104883 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:02.747267008 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:02.867291927 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:02.867386103 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:02.987303019 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:02.987445116 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:03.107434988 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:03.107496023 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:03.227252960 CET	5137	49978	82.193.104.21	192.168.2.7
Dec 16, 2024 07:42:03.227303982 CET	49978	5137	192.168.2.7	82.193.104.21
Dec 16, 2024 07:42:03.347105980 CET	5137	49978	82.193.104.21	192.168.2.7

Target ID:	0
Start time:	01:37:56
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\Server.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Server.exe"
Imagebase:	0x10000
File size:	44'032 bytes
MD5 hash:	4DF91688458D5A32F5A2BC93B6C81094
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: Njrat, Description: detect njRAT in memory, Source: 00000000.00000000.1255629684.0000000000012000.00000002.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.3714790735.00000000022E1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 0097D5F0 Relevance: 8.4, Strings: 6, Instructions: 904COMMON

Download Yara Rule

Strings

(oq, xrefs: 0097DE52
Hq, xrefs: 0097D9E6
(oq, xrefs: 0097DB1A
,q, xrefs: 0097DECA
,q, xrefs: 0097DED8
(oq, xrefs: 0097DE60

Memory Dump Source

Source File: 00000000.00000002.3714349028.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_Server.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$,q$,q$Hq
API String ID: 0-894188343
Opcode ID: 0931c8fe06b301a1b9c149246bf59e3406c7da048375fe4476659ea9651ff8d9
Instruction ID: 2b6e5515cc7a49ec2ce8b0d4eca0887096308dd387dcbe70698b392a70e7d17f
Opcode Fuzzy Hash: 0931c8fe06b301a1b9c149246bf59e3406c7da048375fe4476659ea9651ff8d9
Instruction Fuzzy Hash: 16725B71A012199FDB14DF69C894AAEBBB6FF89300F14C469E409EB3A5DB34DD41CB50

Function 0097A794 Relevance: 1.8, APIs: 1, Instructions: 259
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000000,00000000,?,?,?,00000000,00000000,?), ref: 0097A991

Memory Dump Source

Source File: 00000000.00000002.3714349028.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_Server.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: ec726b035e054cf89b17e6c6c8eede80ca18c89392bb0d21167371494a662711
Instruction ID: c54b5d2ed2f4756e40a398bfef7f7bd1b7e237692169c02ce870779fa3a6e14f
Opcode Fuzzy Hash: ec726b035e054cf89b17e6c6c8eede80ca18c89392bb0d21167371494a662711
Instruction Fuzzy Hash: DDA13972E00359DFEB25CFA9C8447DDBBB6BF88300F25812AE518A7290D7749946CF52

Function 0097A7A0 Relevance: 1.7, APIs: 1, Instructions: 215
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000000,00000000,?,?,?,00000000,00000000,?), ref: 0097A991

Memory Dump Source

Source File: 00000000.00000002.3714349028.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_Server.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fab428ff93fbc702e400c4ab2dd8ccbd211db840a62f147883ae292d4265a1d3
Instruction ID: 63cece02f5c5025c21b73d99a3b62d118abf49fd2a210b336aed57ed5f102e95
Opcode Fuzzy Hash: fab428ff93fbc702e400c4ab2dd8ccbd211db840a62f147883ae292d4265a1d3
Instruction Fuzzy Hash: 7891F572D007599BEB24CFA9C8447DEBBB6AF88300F25812AE518A7250D774A946CF52

Function 0097F4D0 Relevance: 1.7, Strings: 1, Instructions: 413
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Teq, xrefs: 0097F9AF

Memory Dump Source

Source File: 00000000.00000002.3714349028.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_Server.jbxd

Similarity

API ID:
String ID: Teq
API String ID: 0-1098410595
Opcode ID: 907ec48dbbfdf7d84cdf932ebac80b9c0a775fa14389288da9a3057d7825d506
Instruction ID: e976f2260e2b4dfac923eeb75fa383339a2538d62450ba81d13e9b19c6d2f150
Opcode Fuzzy Hash: 907ec48dbbfdf7d84cdf932ebac80b9c0a775fa14389288da9a3057d7825d506
Instruction Fuzzy Hash: 24F19E76A002048FDB15EF68D499BAD77F2BF88321F15C568E529AB3A5DB30EC41CB50

Function 0091D5E0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3714078458.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e679b19409d01acc7a186e99438610b4a22db6e931e0b35dde922f51a4167351
Instruction ID: 04987934d57c95a7bb29c4c3d23ac7bfa930cf72f5baa7fa5764dcd8c5019c96
Opcode Fuzzy Hash: e679b19409d01acc7a186e99438610b4a22db6e931e0b35dde922f51a4167351
Instruction Fuzzy Hash: 492103B1705348DFDB14DF10D9C0B56BF65FB98324F208569E80D0B24AC33AD896CAA2

Function 0092D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3714171235.000000000092D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92d000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd66366810f7dce7010bea64be778d0d71eceb6621ec785d77c54b2f6a8bd711
Instruction ID: 36bd2e529d92134c55291c573efcb74e1758df581dbc0e83388830581a10761b
Opcode Fuzzy Hash: fd66366810f7dce7010bea64be778d0d71eceb6621ec785d77c54b2f6a8bd711
Instruction Fuzzy Hash: 9F210475685340DFDB14DF14E9C4B26BB65FB84314F20C96DD84A4B3AAC33AD847CA62

Function 0092D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3714171235.000000000092D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0092D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_92d000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26b3b473e000c298323a46e119a41dc1f5dc380a1cc70bfd8987fc26bea0da5d
Instruction ID: 53f4535c943edcc3a90bad6a09366703f8b9a5ae775e996c51bfe1ab78ae6429
Opcode Fuzzy Hash: 26b3b473e000c298323a46e119a41dc1f5dc380a1cc70bfd8987fc26bea0da5d
Instruction Fuzzy Hash: 4B219F755493C08FCB16CF24D990715BF71EB46314F28C5EAD8898F6A7C33A980ACB62

Function 0091D5DB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3714078458.000000000091D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0091D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91d000_Server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction ID: 3733464ed01b87e37877d84c5e918a397d9114a69b95dfec994ccba87107e4ae
Opcode Fuzzy Hash: 099256442a3ab3004f72329a4e4b6c70090b87d396c4978555b43c732be305a7
Instruction Fuzzy Hash: E011D376605284CFCB15DF10D9C4B56BF72FB94324F24C5A9D8090B256C336D856CBA1

Non-executed Functions

Function 0097E340 Relevance: 12.2, Strings: 9, Instructions: 905COMMON

Download Yara Rule

Strings

,q, xrefs: 0097E7E0
(oq, xrefs: 0097E455
(oq, xrefs: 0097E84F
(oq, xrefs: 0097E429
,q, xrefs: 0097E7D0
(oq, xrefs: 0097E901
(oq, xrefs: 0097E36E
(oq, xrefs: 0097E83F
(oq, xrefs: 0097E4F2

Memory Dump Source

Source File: 00000000.00000002.3714349028.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_970000_Server.jbxd

Similarity

API ID:
String ID: (oq$(oq$(oq$(oq$(oq$(oq$(oq$,q$,q
API String ID: 0-746337618
Opcode ID: 7273eeb64d9dd6cf7220a13c6afd9fbafc7636ce68012ab3c98e27633db3803e
Instruction ID: 0ea0fac8580b03ef02fe94b91b8c70cf6a71456ed3941b837466a7d6d3ab37bd
Opcode Fuzzy Hash: 7273eeb64d9dd6cf7220a13c6afd9fbafc7636ce68012ab3c98e27633db3803e
Instruction Fuzzy Hash: 5D823976A00209DFCB14CF68D984AAEBBF6FF88314F15C599E4099B2A1D734ED41CB51

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Server.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
Server.exe

Function 0097A794 Relevance: 1.8, APIs: 1, Instructions: 259
processCOMMON

Function 0097A7A0 Relevance: 1.7, APIs: 1, Instructions: 215
processCOMMON

Function 0097F4D0 Relevance: 1.7, Strings: 1, Instructions: 413
COMMON