Create Interactive Tour

Windows Analysis Report
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Overview

General Information

Sample name:	#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe renamed because original name is a hash value
Original sample name:	.exe
Analysis ID:	1646520
MD5:	24ab0ba0700aff18d46f4b4858907567
SHA1:	d4a9f83e3729733d6f9f43bf8d0b475eb0fdba2b
SHA256:	7af0156a84824969e63357b1a5d6913efa7f0df71a2f585a416d0d200a5c5898
Tags:	apkexemalwareuser-malwhere
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Joe Sandbox ML detected suspicious sample

Modifies the windows firewall

Protects its processes via BreakOnTermination flag

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to call native functions

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe (PID: 6744 cmdline: "C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" MD5: 24AB0BA0700AFF18D46F4B4858907567)

netsh.exe (PID: 5708 cmdline: netsh firewall add allowedprogram "C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" "#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 5672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{
  "Host": "2.tcp.eu.ngrok.io",
  "Port": "12629",
  "Version": "im523",
  "Campaign ID": "HacKed",
  "Install Name": "server.exe",
  "Install Dir": "TEMP"
}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efa:$a3: Download ERROR 0x81ec:$a5: netsh firewall delete allowedprogram "
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e2:$a1: netsh firewall add allowedprogram 0x82dc:$b1: [TAP] 0x8282:$b2: & exit 0x824e:$c1: md.exe /k ping 0 & del
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81ec:$s1: netsh firewall delete allowedprogram 0x80e2:$s2: netsh firewall add allowedprogram 0x824c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ed6:$s4: Execute ERROR 0x7f36:$s4: Execute ERROR 0x7efa:$s5: Download ERROR 0x8292:$s6: [kl]

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x62c1:$a1: get_Registry 0x7cfa:$a3: Download ERROR 0x7fec:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ee2:$a1: netsh firewall add allowedprogram 0x80dc:$b1: [TAP] 0x8082:$b2: & exit 0x804e:$c1: md.exe /k ping 0 & del
Process Memory Space: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe PID: 6744	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efa:$a3: Download ERROR 0x81ec:$a5: netsh firewall delete allowedprogram "
0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e2:$a1: netsh firewall add allowedprogram 0x82dc:$b1: [TAP] 0x8282:$b2: & exit 0x824e:$c1: md.exe /k ping 0 & del
0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81ec:$s1: netsh firewall delete allowedprogram 0x80e2:$s2: netsh firewall add allowedprogram 0x824c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ed6:$s4: Execute ERROR 0x7f36:$s4: Execute ERROR 0x7efa:$s5: Download ERROR 0x8292:$s6: [kl]

Suricata Signatures

ET MALWARE Bladabindi/njRAT CnC Command (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T05:00:52.224716+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:55.444655+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:59.476526+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:03.658683+0100	2021176	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP

ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T05:00:52.224716+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:55.444655+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:59.476526+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:03.658683+0100	2033132	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP

ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T05:00:57.933254+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:44.464485+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:46.292957+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:52.136320+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:52.308329+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:56.319874+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:58.955495+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:01.610938+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:04.335423+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:06.402609+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:06.883739+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:15.890880+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:16.039417+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:16.409883+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.259125+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.430637+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.602087+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.579422+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.750413+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.921815+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.093939+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.265358+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.436455+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:37.605729+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.255464+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.596355+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.769081+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.931391+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:40.102238+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.139401+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.310356+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.481472+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:48.849395+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:51.576373+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:03:00.162368+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.274599+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.788905+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.960915+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.302915+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.474743+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.645644+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:08.521173+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:08.692817+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:08.866571+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.210628+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.382579+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.727425+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:10.585167+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:10.759472+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:11.101206+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:11.272261+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:11.443851+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:14.344733+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:17.172470+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:19.754574+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:22.602505+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:25.928449+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:30.564321+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:30.738620+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:31.747002+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:31.918023+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.439981+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.781750+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.952638+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:33.677969+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:33.849522+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:37.340840+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:37.858643+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:38.201757+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:41.267788+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:42.862680+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.034621+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.205508+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.893324+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:44.760276+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.488792+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.661590+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.833213+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.004093+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.174915+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.345963+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.517208+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.861448+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:47.035214+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:47.206109+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.054479+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.227390+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.398478+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.570228+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.741454+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.913840+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.084876+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.258269+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.432007+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.607469+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:52.680343+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:04.694136+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:07.292121+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:07.499873+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:10.097256+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:12.751599+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:31.541280+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:31.886142+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:34.823904+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:36.966604+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.138478+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.315674+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.488229+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.660138+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.833887+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.005742+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.521433+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.693300+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.864920+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:41.687709+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:42.006737+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:42.215477+0100	2825564	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP

ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T05:00:37.714003+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:00:37.714003+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:00:37.714003+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:01:57.004033+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:57.516922+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:58.036454+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:58.560741+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:59.468362+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:59.986473+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:00.542471+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:01.055047+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:02.122953+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:02.889224+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:03.401698+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:04.088770+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:05.025036+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:05.709220+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:06.199108+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:06.883739+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:07.740751+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:08.256768+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:08.952988+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:09.501867+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:10.013451+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:10.525971+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:11.039051+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:11.551072+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:12.062873+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:12.574559+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:13.087226+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:14.114583+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:14.628638+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:15.143062+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:15.720456+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:16.926537+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:17.442707+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:18.125406+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:18.810355+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:19.499647+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:20.183542+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:20.695848+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.259125+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.765754+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:22.279597+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:22.842418+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:23.414776+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:23.926807+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:24.438706+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:24.962204+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:25.650691+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:26.166596+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:26.726169+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:27.583395+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:28.099021+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:28.612197+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:29.124517+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:29.636763+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:30.149427+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:30.662974+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.359301+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.916025+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.428456+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.944382+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:33.461139+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:33.987303+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:34.507182+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:35.020908+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:35.537329+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:36.060159+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:36.639262+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:37.153868+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:38.392737+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:38.899114+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.412603+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.931391+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:40.788822+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:41.481159+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:42.001437+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:42.515883+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:43.032949+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:43.553137+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.139401+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.645574+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:45.159659+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:45.889245+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:46.404014+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:47.104673+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:47.622295+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:48.139484+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:48.849395+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:49.537897+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:50.059165+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:50.578681+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:51.103218+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:52.278238+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:52.968979+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:53.482484+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:54.176229+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:54.782934+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:55.297312+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:55.813721+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:56.326417+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:56.842314+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:03:01.022265+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:01.541266+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:02.059532+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:02.620897+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:03.314612+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:03.758951+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.261325+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.777248+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.292366+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.809506+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:06.368136+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:07.055734+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:07.570336+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:08.159424+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.022652+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.714921+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:10.227969+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:10.742280+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:11.426854+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:12.460027+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:13.145929+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:13.830610+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:14.860224+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:15.547968+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:16.064724+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:16.588984+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:17.515258+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:18.030642+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:18.544699+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:19.068114+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:19.754574+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:20.612695+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:21.302643+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:21.818642+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:22.334314+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:23.458542+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:23.985120+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:24.526718+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:25.041633+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:25.415302+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:25.897921+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:26.413033+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:26.928688+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:27.319721+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:27.800790+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:28.322637+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:28.706628+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:29.357615+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:30.218748+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:30.726660+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:31.059032+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:31.575815+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.439981+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.950656+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:33.465584+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:33.849522+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:34.210719+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:34.552679+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:35.053058+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:35.569416+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:36.087077+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:36.602186+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:37.168108+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:37.669295+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:38.190546+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:39.058513+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:39.574845+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:40.090660+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:40.606869+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:41.267788+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:42.126707+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:42.690681+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.198234+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.718743+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:44.410356+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:44.933217+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.488792+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.995689+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.509703+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:47.026225+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:47.540475+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.054479+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.390956+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.904340+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.424375+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.941640+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:50.456986+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:50.971930+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:51.493201+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:52.010410+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:52.680343+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:53.368838+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:53.905270+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:54.422851+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:54.937437+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:55.802592+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:56.318706+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:56.892993+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:57.418750+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:57.936087+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:58.450434+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:58.964564+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:59.481010+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:00.166372+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:00.759458+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:01.275505+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:05.213776+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:05.731394+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:06.423539+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:06.947318+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:08.189345+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:08.880013+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:09.396261+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:10.619762+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:11.312938+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:11.890735+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:12.406758+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:13.275584+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:13.971479+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:14.673087+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:15.189065+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:15.883086+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:16.577483+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:17.095039+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:17.673474+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:18.227886+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:18.744187+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:19.260516+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:19.777116+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:20.435505+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:20.954146+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:21.472767+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:21.988714+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:22.506122+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:23.023927+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:23.541929+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:24.109605+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:24.627593+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:25.144205+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:25.609370+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:26.126092+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:26.657330+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:27.174270+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:27.694122+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:28.209900+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:28.729879+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:29.129816+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:29.607030+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:30.123276+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:30.639033+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:31.167972+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:32.573917+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:33.266528+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:33.786755+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:34.308782+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:35.344313+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:35.863479+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:36.389667+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:36.955535+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.473625+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.990859+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.508701+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:39.026428+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:40.061435+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:40.578907+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:41.109863+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:41.658411+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:42.735336+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:43.253185+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:43.774808+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:44.291062+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:44.808247+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:45.327123+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:45.847455+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:46.545781+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:47.065895+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:47.582636+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:48.098661+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:48.659988+0100	2814860	1	Malware Command and Control Activity Detected	192.168.2.4	49727	18.157.68.73	12629	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Spreading
• Networking
• Key, Mouse, Clipboard, Microphone and Screen Capturing
• E-Banking Fraud
• Operating System Destruction
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Lowering of HIPS / PFW / Operating System Security Settings
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Avira: detected

Found malware configuration

Source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: Njrat {"Host": "2.tcp.eu.ngrok.io", "Port": "12629", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "server.exe", "Install Dir": "TEMP"}

Multi AV Scanner detection for submitted file

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	ReversingLabs: Detection: 94%
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Virustotal: Detection: 82%			Perma Link

Yara detected Njrat

Source: Yara match	File source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE
Source: Yara match	File source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe PID: 6744, type: MEMORYSTR

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, 00000000.00000002.3635175885.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, 00000000.00000002.3635175885.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Binary or memory string: autorun.inf
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Binary or memory string: [autorun]

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49717 -> 18.156.13.209:12629
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49717 -> 18.156.13.209:12629
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49717 -> 18.156.13.209:12629
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49724 -> 3.127.138.57:12629
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49724 -> 3.127.138.57:12629
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49724 -> 3.127.138.57:12629
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49726 -> 18.197.239.5:12629
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49726 -> 18.197.239.5:12629
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:49724 -> 3.127.138.57:12629
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49726 -> 18.197.239.5:12629
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:49726 -> 18.197.239.5:12629
Source: Network traffic	Suricata IDS: 2033132 - Severity 1 - ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll) : 192.168.2.4:49727 -> 18.157.68.73:12629
Source: Network traffic	Suricata IDS: 2021176 - Severity 1 - ET MALWARE Bladabindi/njRAT CnC Command (ll) : 192.168.2.4:49727 -> 18.157.68.73:12629
Source: Network traffic	Suricata IDS: 2825564 - Severity 1 - ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act) : 192.168.2.4:49727 -> 18.157.68.73:12629
Source: Network traffic	Suricata IDS: 2814860 - Severity 1 - ETPRO MALWARE njRAT/Bladabindi CnC Callback (act) : 192.168.2.4:49727 -> 18.157.68.73:12629

Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 18.156.13.209:12629
Source: global traffic	TCP traffic: 192.168.2.4:49724 -> 3.127.138.57:12629
Source: global traffic	TCP traffic: 192.168.2.4:49726 -> 18.197.239.5:12629
Source: global traffic	TCP traffic: 192.168.2.4:49727 -> 18.157.68.73:12629

Source: Joe Sandbox View	IP Address: 18.156.13.209 18.156.13.209
Source: Joe Sandbox View	IP Address: 3.127.138.57 3.127.138.57
Source: Joe Sandbox View	IP Address: 18.157.68.73 18.157.68.73
Source: Joe Sandbox View	IP Address: 18.197.239.5 18.197.239.5

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 2.tcp.eu.ngrok.io

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

String found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, kl.cs

.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE
Source: Yara match	File source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe PID: 6744, type: MEMORYSTR

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Code function: 0_2_00A4B736 NtSetInformationProcess,		0_2_00A4B736
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Code function: 0_2_00A4B714 NtSetInformationProcess,		0_2_00A4B714

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, 00000000.00000002.3634681172.0000000000BFE000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@4/4

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Code function: 0_2_00A4B3E6 AdjustTokenPrivileges,		0_2_00A4B3E6
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Code function: 0_2_00A4B3AF AdjustTokenPrivileges,		0_2_00A4B3AF

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Mutant created: \Sessions\1\BaseNamedObjects\2025b9f237c2fb27c13d52e4a198434b
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5672:120:WilError_03
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	ReversingLabs: Detection: 94%
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Virustotal: Detection: 82%

Source: unknown	Process created: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe "C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe"
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" "#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" "#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, OK.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Memory allocated: AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Memory allocated: 4A80000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Window / User API: threadDelayed 1179	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Window / User API: threadDelayed 3803	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Window / User API: threadDelayed 4538	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Window / User API: foregroundWindowGot 1767	Jump to behavior

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe TID: 6648	Thread sleep time: -1179000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe TID: 6648	Thread sleep time: -4538000s >= -30000s			Jump to behavior

Source: netsh.exe, 00000002.00000003.1245042416.00000000009B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, 00000000.00000002.3634681172.0000000000C61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWws" type="System.Configuration.IgnoreSection, System.Configuration, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowLocation="false"/>
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, 00000000.00000002.3634681172.0000000000C61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, 00000000.00000002.3635175885.0000000002AFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9tl
Source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, 00000000.00000002.3635175885.0000000002AFC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" "#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE
Source: Yara match	File source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe PID: 6744, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe, type: SAMPLE
Source: Yara match	File source: 0.0.#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe PID: 6744, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	2 Virtualization/Sandbox Evasion	1 Input Capture	1 Security Software Discovery	Remote Services	1 Input Capture	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Process Injection	21 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	94%	ReversingLabs	ByteCode-MSIL.Backdoor.njRAT
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	83%	Virustotal		Browse
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	100%	Avira	TR/ATRAPS.Gen

Name	IP	Active	Malicious	Antivirus Detection	Reputation
2.tcp.eu.ngrok.io	18.156.13.209	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0	#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.156.13.209	2.tcp.eu.ngrok.io	United States	16509	AMAZON-02US	true
3.127.138.57	unknown	United States	16509	AMAZON-02US	true
18.157.68.73	unknown	United States	16509	AMAZON-02US	true
18.197.239.5	unknown	United States	16509	AMAZON-02US	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1646520
Start date and time:	2025-03-24 04:59:44 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe renamed because original name is a hash value
Original Sample Name:	.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@4/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 86 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.204.23.20, 172.202.163.200
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:01:22	API Interceptor	1238109x Sleep call for process: #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.156.13.209	http://www.sdrclm.cn/vendor/phpdocumentor/P800/P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/
3.127.138.57	20f8b1d9eabf499dbc7a0bff6ee7ddec.ps1	Get hash	malicious	XWorm	Browse
	mod.exe	Get hash	malicious	Njrat	Browse
	Server.exe	Get hash	malicious	Njrat	Browse
	Discord.exe	Get hash	malicious	AsyncRAT	Browse
	f3aef511705f37f9792c6032b936ca61.exe	Get hash	malicious	Njrat	Browse
	En3e396wX1.exe	Get hash	malicious	Njrat	Browse
	ea1Wv7aq.posh.ps1	Get hash	malicious	Metasploit	Browse
	R3ov8eFFFP.exe	Get hash	malicious	Njrat	Browse
	b8UsrDOVGV.exe	Get hash	malicious	Njrat	Browse
	2G8CgDVl3K.exe	Get hash	malicious	Njrat	Browse
18.157.68.73	mal_temp.dotm.doc	Get hash	malicious	Unknown	Browse	18.157.68.73:11858/exfiltrate
18.197.239.5	ULNZPn6D33.exe	Get hash	malicious	Sliver	Browse	2.tcp.eu.ngrok.io:11642/e.bin
18.197.239.5	P90GT_Invoice_Related_Property_Tax_P800.exe	Get hash	malicious	RedLine	Browse	2.tcp.eu.ngrok.io:17685/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.tcp.eu.ngrok.io	20f8b1d9eabf499dbc7a0bff6ee7ddec.ps1	Get hash	malicious	XWorm	Browse	3.126.37.18
	mod.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	Server.exe	Get hash	malicious	Njrat	Browse	3.127.138.57
	Discord.exe	Get hash	malicious	AsyncRAT	Browse	18.156.13.209
	oiA5KmV0f0.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	7166_output.vbs	Get hash	malicious	AsyncRAT	Browse	18.156.13.209
	fBpY1pYq34.exe	Get hash	malicious	Njrat	Browse	18.157.68.73
	f3aef511705f37f9792c6032b936ca61.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	W9UAjNR4L6.exe	Get hash	malicious	Njrat	Browse	3.126.37.18
	ULNZPn6D33.exe	Get hash	malicious	Sliver	Browse	18.197.239.5

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	gigab.x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	morte.mips.elf	Get hash	malicious	Gafgyt, Okiru	Browse	54.171.230.55
	arm7.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	SecuriteInfo.com.Win64.CrypterX-gen.5834.27621.exe	Get hash	malicious	Vidar	Browse	108.138.128.112
	aarch64.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	54.77.209.255
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	54.247.62.1
	resgod.spc.elf	Get hash	malicious	Mirai	Browse	52.47.230.234
AMAZON-02US	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	gigab.x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	morte.mips.elf	Get hash	malicious	Gafgyt, Okiru	Browse	54.171.230.55
	arm7.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	SecuriteInfo.com.Win64.CrypterX-gen.5834.27621.exe	Get hash	malicious	Vidar	Browse	108.138.128.112
	aarch64.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	54.77.209.255
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	54.247.62.1
	resgod.spc.elf	Get hash	malicious	Mirai	Browse	52.47.230.234
AMAZON-02US	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	gigab.x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	morte.mips.elf	Get hash	malicious	Gafgyt, Okiru	Browse	54.171.230.55
	arm7.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	SecuriteInfo.com.Win64.CrypterX-gen.5834.27621.exe	Get hash	malicious	Vidar	Browse	108.138.128.112
	aarch64.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	54.77.209.255
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	54.247.62.1
	resgod.spc.elf	Get hash	malicious	Mirai	Browse	52.47.230.234
AMAZON-02US	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	gigab.x86.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	morte.mips.elf	Get hash	malicious	Gafgyt, Okiru	Browse	54.171.230.55
	arm7.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	SecuriteInfo.com.Win64.CrypterX-gen.5834.27621.exe	Get hash	malicious	Vidar	Browse	108.138.128.112
	aarch64.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	resgod.arm5.elf	Get hash	malicious	Mirai	Browse	54.77.209.255
	na.elf	Get hash	malicious	Prometei	Browse	52.43.119.120
	na.elf	Get hash	malicious	Prometei	Browse	54.247.62.1
	resgod.spc.elf	Get hash	malicious	Mirai	Browse	52.47.230.234

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2496
Entropy (8bit):	4.934041687320963
Encrypted:	false
SSDEEP:	48:DOOYuR3qmbq0aLxgkVMr72W1GUVbEpouMm5XF30u3s:yERz3rpr/EpouMmxFr3s
MD5:	4150D65E7F2F5DB6B158174958CACBB9
SHA1:	990E4F9CC1D4E26D00717D6861780DC8B0B886C7
SHA-256:	4EFF50E9310BBDD1C49C55CC40F5E4D7182ACCDE2538264AE22899807FC378D9
SHA-512:	D0A8C9021C3FAE939F75D3CEFFF89A68B2E478B6E9EF3B0BA4AA806774830CA9CDE686CD982684D7E7D6D1CFDF3749E43C30C7CA88E9785BA1CD408AA1B28EF7
Malicious:	false
Reputation:	low
Preview:	The syntax supplied for this command is not valid. Check help for the correct syntax.....add allowedprogram.. [ program = ] path.. [ name = ] name.. [ [ mode = ] ENABLE\|DISABLE.. [ scope = ] ALL\|SUBNET\|CUSTOM.. [ addresses = ] addresses.. [ profile = ] CURRENT\|DOMAIN\|STANDARD\|ALL ].... Adds firewall allowed program configuration..... Parameters:.... program - Program path and file name..... name - Program name..... mode - Program mode (optional)... ENABLE - Allow through firewall (default)... DISABLE - Do not allow through firewall..... scope - Program scope (optional)... ALL - Allow all traffic through firewall (default)... SUBNET - Allow only local network (subnet) traffic through firewall... CUSTOM - Allow only specified traffic through firewall..... addresses - Custom scope addresses (optional)... This comma-separated scope can contain IPv4 addresses,.. IPv6 addresses, subnets, ranges,

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.577802598719638
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe
File size:	37'888 bytes
MD5:	24ab0ba0700aff18d46f4b4858907567
SHA1:	d4a9f83e3729733d6f9f43bf8d0b475eb0fdba2b
SHA256:	7af0156a84824969e63357b1a5d6913efa7f0df71a2f585a416d0d200a5c5898
SHA512:	b3d404452b01720f4a4756e8e409cdee93e830186e78c4c30c3247caab4150c98987fb507657a6f929fb5d26a02a5092a873cb8883521a5b06da7b362ac4e727
SSDEEP:	384:VetvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXX:4t7TZ38fvCv3E1c1rM+rMRa8Nu8it
TLSH:	75032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EF664AA37636C18B50EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....h.e................................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40abbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x65DF68F0 [Wed Feb 28 17:10:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xab6c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x240	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8bc4	0x8c00	4737d2b3e262ffe62c3c6af9955bd0b0	False	0.46353236607142856	data	5.609403108970339	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x240	0x400	f7ce2f7b506ce16c06c85a549ef2cd98	False	0.3134765625	data	4.968771659524424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	163d66697186c0743c0da6f82247a39a	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc058	0x1e7	XML 1.0 document, ASCII text, with CRLF line terminators			0.5338809034907598

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-24T05:00:37.714003+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:00:37.714003+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:00:37.714003+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:00:52.224716+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:00:52.224716+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:00:57.933254+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:44.464485+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:46.292957+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:52.136320+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:52.308329+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49717	18.156.13.209	12629	TCP
2025-03-24T05:01:55.444655+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:55.444655+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:56.319874+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:57.004033+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:57.516922+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:58.036454+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:58.560741+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:58.955495+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:59.468362+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:01:59.986473+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:00.542471+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:01.055047+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:01.610938+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:02.122953+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:02.889224+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:03.401698+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:04.088770+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:04.335423+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:05.025036+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:05.709220+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:06.199108+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:06.402609+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:06.883739+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:06.883739+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:07.740751+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:08.256768+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:08.952988+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:09.501867+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:10.013451+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:10.525971+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:11.039051+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:11.551072+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:12.062873+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:12.574559+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:13.087226+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:14.114583+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:14.628638+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:15.143062+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:15.720456+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:15.890880+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:16.039417+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:16.409883+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:16.926537+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:17.442707+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:18.125406+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:18.810355+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:19.499647+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:20.183542+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:20.695848+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.259125+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.259125+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.430637+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.602087+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:21.765754+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:22.279597+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:22.842418+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:23.414776+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:23.926807+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:24.438706+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:24.962204+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:25.650691+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:26.166596+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:26.726169+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:27.583395+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:28.099021+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:28.612197+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:29.124517+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:29.636763+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:30.149427+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:30.662974+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.359301+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.579422+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.750413+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.916025+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:31.921815+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.093939+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.265358+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.428456+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.436455+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:32.944382+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:33.461139+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:33.987303+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:34.507182+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:35.020908+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:35.537329+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:36.060159+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:36.639262+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:37.153868+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:37.605729+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:38.392737+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:38.899114+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.255464+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.412603+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.596355+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.769081+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.931391+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:39.931391+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:40.102238+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:40.788822+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:41.481159+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:42.001437+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:42.515883+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:43.032949+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:43.553137+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.139401+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.139401+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.310356+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.481472+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:44.645574+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:45.159659+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:45.889245+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:46.404014+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:47.104673+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:47.622295+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:48.139484+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:48.849395+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:48.849395+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:49.537897+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:50.059165+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:50.578681+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:51.103218+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:51.576373+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:52.278238+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:52.968979+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:53.482484+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:54.176229+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:54.782934+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:55.297312+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:55.813721+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:56.326417+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:56.842314+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49724	3.127.138.57	12629	TCP
2025-03-24T05:02:59.476526+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:02:59.476526+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:00.162368+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:01.022265+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:01.541266+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:02.059532+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:02.620897+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:03.314612+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:03.758951+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.261325+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.274599+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.777248+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.788905+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:04.960915+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.292366+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.302915+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.474743+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.645644+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:05.809506+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:06.368136+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:07.055734+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:07.570336+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:08.159424+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:08.521173+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:08.692817+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:08.866571+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.022652+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.210628+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.382579+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.714921+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:09.727425+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:10.227969+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:10.585167+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:10.742280+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:10.759472+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:11.101206+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:11.272261+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:11.426854+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:11.443851+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:12.460027+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:13.145929+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:13.830610+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:14.344733+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:14.860224+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:15.547968+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:16.064724+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:16.588984+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:17.172470+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:17.515258+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:18.030642+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:18.544699+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:19.068114+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:19.754574+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:19.754574+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:20.612695+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:21.302643+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:21.818642+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:22.334314+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:22.602505+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:23.458542+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:23.985120+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:24.526718+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:25.041633+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:25.415302+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:25.897921+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:25.928449+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:26.413033+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:26.928688+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:27.319721+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:27.800790+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:28.322637+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:28.706628+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:29.357615+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:30.218748+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:30.564321+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:30.726660+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:30.738620+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:31.059032+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:31.575815+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:31.747002+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:31.918023+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.439981+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.439981+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.781750+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.950656+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:32.952638+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:33.465584+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:33.677969+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:33.849522+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:33.849522+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:34.210719+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:34.552679+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:35.053058+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:35.569416+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:36.087077+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:36.602186+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:37.168108+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:37.340840+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:37.669295+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:37.858643+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:38.190546+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:38.201757+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:39.058513+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:39.574845+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:40.090660+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:40.606869+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:41.267788+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:41.267788+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:42.126707+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:42.690681+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:42.862680+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.034621+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.198234+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.205508+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.718743+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:43.893324+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:44.410356+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:44.760276+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:44.933217+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.488792+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.488792+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.661590+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.833213+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:45.995689+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.004093+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.174915+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.345963+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.509703+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.517208+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:46.861448+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:47.026225+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:47.035214+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:47.206109+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:47.540475+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.054479+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.054479+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.227390+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.390956+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.398478+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.570228+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.741454+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.904340+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:48.913840+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.084876+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.258269+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.424375+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.432007+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.607469+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:49.941640+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:50.456986+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:50.971930+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:51.493201+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:52.010410+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:52.680343+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:52.680343+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:53.368838+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:53.905270+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:54.422851+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:54.937437+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:55.802592+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:56.318706+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:56.892993+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:57.418750+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:57.936087+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:58.450434+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:58.964564+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:03:59.481010+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:00.166372+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:00.759458+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:01.275505+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49726	18.197.239.5	12629	TCP
2025-03-24T05:04:03.658683+0100	2033132	ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:03.658683+0100	2021176	ET MALWARE Bladabindi/njRAT CnC Command (ll)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:04.694136+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:05.213776+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:05.731394+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:06.423539+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:06.947318+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:07.292121+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:07.499873+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:08.189345+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:08.880013+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:09.396261+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:10.097256+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:10.619762+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:11.312938+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:11.890735+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:12.406758+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:12.751599+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:13.275584+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:13.971479+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:14.673087+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:15.189065+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:15.883086+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:16.577483+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:17.095039+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:17.673474+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:18.227886+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:18.744187+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:19.260516+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:19.777116+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:20.435505+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:20.954146+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:21.472767+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:21.988714+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:22.506122+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:23.023927+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:23.541929+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:24.109605+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:24.627593+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:25.144205+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:25.609370+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:26.126092+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:26.657330+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:27.174270+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:27.694122+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:28.209900+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:28.729879+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:29.129816+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:29.607030+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:30.123276+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:30.639033+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:31.167972+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:31.541280+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:31.886142+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:32.573917+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:33.266528+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:33.786755+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:34.308782+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:34.823904+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:35.344313+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:35.863479+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:36.389667+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:36.955535+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:36.966604+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.138478+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.315674+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.473625+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.488229+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.660138+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.833887+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:37.990859+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.005742+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.508701+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.521433+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.693300+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:38.864920+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:39.026428+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:40.061435+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:40.578907+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:41.109863+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:41.658411+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:41.687709+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:42.006737+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:42.215477+0100	2825564	ETPRO MALWARE Generic njRAT/Bladabindi CnC Activity (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:42.735336+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:43.253185+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:43.774808+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:44.291062+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:44.808247+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:45.327123+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:45.847455+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:46.545781+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:47.065895+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:47.582636+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:48.098661+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP
2025-03-24T05:04:48.659988+0100	2814860	ETPRO MALWARE njRAT/Bladabindi CnC Callback (act)	1	192.168.2.4	49727	18.157.68.73	12629	TCP

Network Port Distribution

Total Packets: 1320
• 12629 undefined
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 05:00:51.909310102 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:00:52.080684900 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:00:52.080985069 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:00:52.224715948 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:00:52.395451069 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:00:52.395535946 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:00:52.566257954 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:00:57.933254004 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:00:58.106159925 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:13.508101940 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:13.508263111 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:01:28.868149996 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:28.868220091 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:01:44.228188992 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:44.228293896 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:01:44.464484930 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:01:44.635406971 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:46.292957067 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:01:46.464771986 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:52.136320114 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:01:52.308224916 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:52.308329105 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:01:52.479131937 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:53.152355909 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:53.152544022 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:01:55.168499947 CET	49717	12629	192.168.2.4	18.156.13.209
Mar 24, 2025 05:01:55.270626068 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:55.339560032 CET	12629	49717	18.156.13.209	192.168.2.4
Mar 24, 2025 05:01:55.441056013 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:55.441189051 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:55.444654942 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:55.614891052 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:55.614988089 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:55.785383940 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:55.785548925 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:55.955782890 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:55.958492994 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:56.129031897 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:56.130335093 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:56.303154945 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:56.319874048 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:56.490312099 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:56.490449905 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:56.661365986 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:56.661490917 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:56.831890106 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:56.832041025 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:57.003782988 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:57.004033089 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:57.175153017 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:57.175319910 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:57.345825911 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:57.345999002 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:57.516781092 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:57.516921997 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:57.687902927 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:57.689209938 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:57.860589027 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:57.864897013 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:58.036329031 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:58.036453962 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:58.207602978 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:58.207753897 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:58.381340027 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:58.384870052 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:58.559570074 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:58.560740948 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:58.737386942 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:58.737504959 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:58.909562111 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:58.955495119 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:59.126097918 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:59.126271963 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:59.297472000 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:59.297667027 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:59.468173027 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:59.468362093 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:59.638946056 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:59.642576933 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:59.813853025 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:59.814500093 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:01:59.984875917 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:01:59.986473083 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:00.157896042 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:00.158063889 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:00.369544983 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:00.369663000 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:00.540843964 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:00.542470932 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:00.713232040 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:00.713346004 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:00.883970976 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:00.884089947 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:01.054929972 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:01.055047035 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:01.225636959 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:01.225724936 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:01.396130085 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:01.396215916 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:01.568290949 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:01.610938072 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:01.781398058 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:01.781563997 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:01.952002048 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:01.952116013 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:02.122879028 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:02.122952938 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:02.293339014 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:02.293458939 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:02.463860035 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:02.463989973 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:02.634314060 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:02.634495974 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:02.889106035 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:02.889224052 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:03.059648991 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:03.059796095 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:03.230691910 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:03.230808973 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:03.401422024 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:03.401698112 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:03.572423935 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:03.572526932 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:03.745359898 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:03.745456934 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:03.918176889 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:03.918251038 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:04.088685989 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:04.088769913 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:04.259242058 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:04.335422993 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:04.507303953 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:04.507406950 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:04.677787066 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:04.680733919 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:04.851741076 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:04.853140116 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:05.024930000 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:05.025036097 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:05.197386026 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:05.197545052 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:05.369827986 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:05.370050907 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:05.682924032 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:05.709126949 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:05.709219933 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:05.853543997 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:05.856596947 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:05.879559994 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:05.881381035 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.027316093 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.027409077 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.052011967 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.053235054 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.198890924 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.199107885 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.224833012 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.229540110 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.369462967 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.370496988 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.399895906 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.402609110 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.541841984 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.542485952 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.573061943 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.573635101 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.712985992 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.713222980 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:06.744240046 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.883636951 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:06.883738995 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:07.054182053 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:07.054239988 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:07.224776030 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:07.224884987 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:07.395147085 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:07.395267963 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:07.565793037 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:07.565973043 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:07.736488104 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:07.740751028 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:07.911264896 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:07.911401987 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:08.082359076 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:08.084537983 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:08.254864931 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:08.256767988 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:08.427443981 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:08.430519104 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:08.602303028 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:08.602546930 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:08.779242992 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:08.779350042 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:08.952836990 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:08.952987909 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:09.123891115 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:09.124102116 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:09.331137896 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:09.369113922 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:09.369220972 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:09.501780033 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:09.501867056 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:09.540923119 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:09.540993929 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:09.672209024 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:09.672425985 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:09.711631060 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:09.711730003 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:09.842860937 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:09.842993021 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:09.881975889 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:09.882042885 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.013305902 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.013451099 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.052402973 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.052505970 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.183924913 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.184065104 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.222991943 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.223094940 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.354537010 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.354672909 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.393455029 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.393548965 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.525732040 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.525970936 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.564100981 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.564202070 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.696811914 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.696945906 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.734638929 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.734895945 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.868014097 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.868127108 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:10.905131102 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:10.905297041 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.038963079 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.039051056 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.077116966 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.077229023 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.209633112 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.209717989 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.247526884 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.247589111 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.380425930 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.380548000 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.420254946 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.420366049 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.550978899 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.551071882 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.591377020 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.591444969 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.721519947 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.721775055 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.761845112 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.762068033 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.892220020 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.892353058 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:11.932379961 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:11.932598114 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.062767982 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.062872887 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.102839947 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.103226900 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.233072996 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.233164072 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.274192095 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.274279118 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.403577089 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.403709888 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.444636106 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.444771051 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.574412107 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.574558973 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.615896940 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.616019011 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.745213032 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.745361090 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.786969900 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.787062883 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.916034937 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.916121006 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:12.959074974 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:12.959180117 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:13.087101936 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:13.087225914 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:13.129801035 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:13.129894972 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:13.257608891 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:13.257754087 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:13.300146103 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:13.300211906 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:13.428427935 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:13.428582907 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:13.470689058 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:13.600378990 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:13.600502968 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:13.770881891 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:13.770951033 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:13.941446066 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:13.941524029 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:14.114032984 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:14.114583015 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:14.285630941 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:14.286525965 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:14.456983089 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:14.457096100 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:14.627496004 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:14.628638029 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:14.800779104 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:14.801553011 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:14.972156048 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:14.972289085 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:15.142947912 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:15.143062115 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:15.313885927 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:15.316525936 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:15.491077900 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:15.492604971 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:15.697103977 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:15.720263004 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:15.720455885 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:15.867753029 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:15.867872953 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:15.890815973 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:15.890880108 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:16.039169073 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:16.039417028 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:16.061270952 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:16.209983110 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:16.409883022 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:16.580954075 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:16.581059933 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:16.751904011 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:16.752993107 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:16.924493074 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:16.926537037 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:17.097007036 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:17.097285032 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:17.268265963 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:17.269349098 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:17.442595959 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:17.442707062 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:17.613315105 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:17.613432884 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:17.783890009 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:17.784009933 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:17.954653025 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:17.954787970 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:18.125166893 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:18.125406027 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:18.295924902 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:18.296103001 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:18.466548920 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:18.466804028 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:18.638463020 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:18.638602018 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:18.810220957 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:18.810354948 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:18.982338905 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:18.982496023 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:19.153696060 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:19.153851986 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:19.328541040 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:19.328654051 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:19.499531984 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:19.499646902 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:19.670196056 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:19.670303106 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:19.840801954 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:19.841023922 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:20.011554956 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:20.012115002 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:20.183304071 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:20.183542013 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:20.353971004 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:20.354124069 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:20.524749994 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:20.524847031 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:20.695626974 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:20.695847988 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:20.866219044 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:20.866445065 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.036880016 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:21.037147045 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.251254082 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.259008884 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:21.259124994 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.422749996 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:21.422836065 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.430583000 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:21.430636883 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.594616890 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:21.594867945 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.602014065 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:21.602087021 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.765588999 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:21.765753984 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.773660898 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:21.773716927 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.937028885 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:21.937143087 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:21.944025040 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:22.108721972 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:22.108899117 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:22.279463053 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:22.279597044 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:22.451376915 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:22.451584101 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:22.669853926 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:22.670002937 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:22.842276096 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:22.842417955 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.013550997 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.013668060 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.244033098 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.269033909 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.269104958 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.414516926 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.414776087 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.442384005 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.442579031 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.585350037 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.585541010 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.614365101 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.614448071 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.756019115 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.756253004 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.784657955 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.784732103 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.926707983 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.926806927 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:23.955027103 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:23.955099106 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.097309113 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.097459078 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.125418901 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.125536919 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.267848015 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.268065929 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.296497107 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.296696901 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.438585997 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.438705921 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.467972994 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.468029976 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.612715006 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.612850904 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.639993906 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.640125036 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.788727999 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.788850069 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.811664104 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.811726093 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.962100983 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:24.962203979 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:24.999746084 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:25.133066893 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:25.133147955 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:25.303627014 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:25.303769112 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:25.474663019 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:25.474823952 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:25.650587082 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:25.650691032 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:25.822098017 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:25.822618961 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:25.993649960 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:25.994673967 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:26.165060043 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:26.166595936 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:26.379482985 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:26.382642984 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:26.553153038 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:26.553858042 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:26.725984097 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:26.726169109 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:26.897376060 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:26.897481918 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:27.070220947 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:27.070323944 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:27.241067886 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:27.241427898 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:27.412101030 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:27.412184954 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:27.583201885 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:27.583395004 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:27.754045010 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:27.754276991 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:27.927011967 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:27.927232981 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:28.098845959 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:28.099020958 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:28.270337105 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:28.270504951 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:28.441180944 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:28.441401005 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:28.612018108 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:28.612196922 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:28.782987118 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:28.783163071 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:28.953855991 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:28.953969955 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:29.124393940 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:29.124516964 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:29.295224905 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:29.295391083 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:29.465923071 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:29.466114998 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:29.636641979 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:29.636763096 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:29.807353020 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:29.807538986 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:29.978137016 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:29.978352070 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:30.149234056 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:30.149426937 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:30.319792032 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:30.319938898 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:30.490432978 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:30.490555048 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:30.662605047 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:30.662974119 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:30.839154959 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:30.839281082 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:31.010516882 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:31.010647058 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:31.186564922 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:31.186713934 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:31.358887911 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:31.359301090 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:31.572751045 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:31.579272032 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:31.579421997 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:31.744828939 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:31.745048046 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:31.750309944 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:31.750412941 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:31.915812016 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:31.916024923 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:31.921675920 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:31.921814919 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:32.086621046 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.086762905 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:32.093853951 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.093939066 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:32.257450104 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.257630110 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:32.265242100 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.265357971 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:32.428111076 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.428456068 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:32.436335087 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.436455011 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:32.602360964 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.602463961 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:32.606930971 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.773231983 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.773351908 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:32.944216967 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:32.944381952 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:33.115758896 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:33.115925074 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:33.286436081 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:33.286585093 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:33.460819960 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:33.461138964 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:33.639220953 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:33.639475107 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:33.810949087 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:33.811074972 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:33.987112045 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:33.987303019 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:34.162307024 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:34.162554026 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:34.333668947 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:34.333772898 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:34.507019997 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:34.507181883 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:34.678185940 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:34.678435087 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:34.850174904 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:34.850294113 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:35.020785093 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:35.020908117 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:35.192313910 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:35.192430019 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:35.366231918 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:35.366518021 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:35.537200928 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:35.537328959 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:35.709403038 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:35.709521055 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:35.886056900 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:35.886321068 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:36.060055017 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:36.060158968 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:36.240114927 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:36.240236998 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:36.422646999 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:36.422779083 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:36.639108896 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:36.639261961 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:36.811055899 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:36.811211109 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:36.983346939 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:36.983491898 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:37.153774023 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:37.153867960 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:37.324414015 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:37.605729103 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:37.777772903 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:37.777900934 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:37.949060917 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:37.952800035 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:38.126782894 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:38.128531933 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:38.375278950 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:38.389275074 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:38.392736912 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:38.549134970 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:38.549282074 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:38.569076061 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:38.569138050 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:38.726025105 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:38.727515936 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:38.741856098 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:38.741920948 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:38.898952007 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:38.899113894 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:38.912751913 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:38.912841082 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.069744110 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.069873095 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.083967924 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.084042072 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.241156101 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.241379976 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.255383015 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.255464077 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.412484884 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.412602901 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.425879955 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.425947905 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.585254908 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.585361958 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.596285105 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.596354961 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.760042906 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.760173082 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.769001961 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.769081116 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.931315899 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:39.931391001 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:39.940485954 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:40.102164984 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:40.102237940 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:40.273932934 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:40.274173021 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:40.444962978 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:40.445215940 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:40.616736889 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:40.616832018 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:40.788739920 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:40.788821936 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:40.960165977 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:40.960339069 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:41.131309986 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:41.131556034 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:41.303864002 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:41.304069996 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:41.481008053 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:41.481158972 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:41.651849031 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:41.651948929 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:41.822782993 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:41.822860956 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:42.001276970 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:42.001436949 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:42.172559023 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:42.172919035 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:42.344737053 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:42.344974995 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:42.515733957 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:42.515882969 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:42.686557055 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:42.686676979 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:42.857825041 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:42.860977888 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:43.032609940 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:43.032948971 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:43.203751087 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:43.205226898 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:43.376651049 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:43.380650997 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:43.553035021 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:43.553137064 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:43.729687929 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:43.732661963 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:43.910089970 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:43.910223961 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:44.131329060 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:44.139307022 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:44.139400959 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:44.301966906 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:44.302155972 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:44.310259104 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:44.310355902 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:44.473675966 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:44.473793983 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:44.481415033 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:44.481472015 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:44.645462990 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:44.645574093 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:44.652957916 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:44.816663980 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:44.816772938 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:44.988127947 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:44.988285065 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:45.159490108 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:45.159658909 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:45.330251932 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:45.330343962 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:45.500932932 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:45.501033068 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:45.671735048 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:45.671919107 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:45.889097929 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:45.889245033 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:46.061316967 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:46.061434031 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:46.232198954 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:46.232466936 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:46.403897047 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:46.404014111 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:46.574718952 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:46.574812889 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:46.748639107 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:46.748872042 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:46.931766033 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:46.931992054 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:47.104513884 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:47.104672909 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:47.277573109 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:47.277714968 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:47.448462009 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:47.448556900 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:47.622179031 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:47.622294903 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:47.794516087 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:47.795057058 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:47.965846062 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:47.966650963 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:48.138576984 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:48.139483929 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:48.310383081 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:48.310626984 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:48.481508017 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:48.482690096 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:48.653393984 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:48.654602051 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:48.825973988 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:48.849395037 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:49.021224022 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:49.021312952 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:49.195874929 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:49.196098089 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:49.366724968 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:49.366965055 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:49.537805080 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:49.537897110 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:49.714498043 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:49.714618921 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:49.885497093 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:49.886605024 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:50.059056044 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:50.059165001 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:50.230994940 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:50.234596014 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:50.406182051 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:50.406579971 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:50.578541040 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:50.578680992 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:50.750086069 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:50.750591993 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:50.932586908 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:51.009175062 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:51.009305000 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:51.103115082 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:51.103218079 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:51.183613062 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:51.183708906 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:51.282136917 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:51.360934019 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:51.576373100 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:51.747322083 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:51.747603893 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:51.930522919 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:51.934597015 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:52.105593920 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:52.105741024 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:52.278110027 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:52.278238058 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:52.449453115 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:52.449552059 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:52.625559092 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:52.625674963 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:52.798271894 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:52.798377991 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:52.968874931 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:52.968978882 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:53.139369965 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:53.139494896 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:53.310161114 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:53.310278893 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:53.482372046 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:53.482484102 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:53.653374910 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:53.653482914 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:53.824836969 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:53.826608896 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.002487898 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:54.005220890 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.175955057 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:54.176229000 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.348530054 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:54.350640059 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.610852957 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.651844978 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.689162970 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:54.689275980 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.782713890 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:54.782933950 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.822495937 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:54.822673082 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.859780073 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:54.859922886 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.954283953 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:54.954552889 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:54.993367910 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:54.993566036 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.034327984 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.034456015 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.125462055 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.125726938 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.164135933 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.164422035 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.213457108 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.213542938 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.297188044 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.297312021 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.337390900 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.337559938 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.387173891 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.387440920 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.469844103 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.469970942 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.508467913 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.508542061 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.558659077 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.558732033 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.642115116 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.642210007 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.678834915 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.678930044 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.729196072 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.729335070 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.813623905 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.813720942 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.851550102 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.851628065 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.900252104 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.900379896 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:55.984395981 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:55.984627962 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.022602081 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.022872925 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.071553946 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.071768045 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.155342102 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.155482054 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.194418907 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.194534063 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.243014097 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.243248940 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.326245070 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.326416969 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.365734100 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.365834951 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.413937092 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.414038897 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.497808933 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.498003960 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.537460089 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.537564993 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.590249062 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.590502977 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.668865919 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.669083118 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.708448887 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.708595037 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.761204004 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.761353016 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.842171907 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.842314005 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.881191015 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.881280899 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:56.931942940 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:56.932035923 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:57.016150951 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:57.016354084 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:57.052170992 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:57.052258968 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:57.103193045 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:57.103264093 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:57.154751062 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:57.154891968 CET	49724	12629	192.168.2.4	3.127.138.57
Mar 24, 2025 05:02:57.187856913 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:57.222518921 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:57.325228930 CET	12629	49724	3.127.138.57	192.168.2.4
Mar 24, 2025 05:02:59.299974918 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:02:59.472048044 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:02:59.472178936 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:02:59.476526022 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:02:59.647291899 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:02:59.647420883 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:02:59.818526983 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:02:59.818633080 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:02:59.990964890 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:02:59.991208076 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:00.162267923 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:00.162368059 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:00.334788084 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:00.334852934 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:00.508150101 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:00.508239985 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:00.679223061 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:00.679335117 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:00.850928068 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:00.851038933 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:01.022136927 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:01.022264957 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:01.194155931 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:01.196913004 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:01.368053913 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:01.368243933 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:01.539577961 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:01.541265965 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:01.712352991 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:01.712848902 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:01.884176016 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:01.885003090 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:02.059351921 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:02.059531927 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:02.231930017 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:02.233355999 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:02.405811071 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:02.406821966 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:02.618108988 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:02.620897055 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:02.798904896 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:02.799089909 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:02.971678972 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:02.971781969 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:03.143112898 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:03.143193960 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:03.314511061 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:03.314611912 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:03.565395117 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:03.587910891 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:03.588027000 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:03.736912012 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:03.737081051 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:03.758842945 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:03.758950949 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:03.908575058 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:03.910756111 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:03.929754019 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:03.930666924 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.083368063 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.086615086 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.102106094 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.102567911 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.259607077 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.261324883 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.273592949 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.274599075 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.432167053 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.433228970 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.445477962 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.446567059 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.604234934 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.604877949 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.617364883 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.617485046 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.777132988 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.777247906 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.788834095 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.788904905 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.949683905 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.949815989 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:04.960815907 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:04.960915089 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.121123075 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.121259928 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.131654024 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.131735086 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.292129993 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.292366028 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.302823067 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.302915096 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.464714050 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.464911938 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.474612951 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.474742889 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.637384892 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.637553930 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.645530939 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.645643950 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.809376955 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.809505939 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:05.817215919 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.983233929 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:05.983380079 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:06.155194044 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:06.155318975 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:06.367984056 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:06.368135929 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:06.539438009 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:06.539545059 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:06.711232901 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:06.711448908 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:06.883965015 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:06.884151936 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:07.055555105 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:07.055733919 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:07.227468967 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:07.227766991 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:07.398941994 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:07.399108887 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:07.570204020 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:07.570336103 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:07.741364002 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:07.741542101 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:07.987513065 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.007962942 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.008083105 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.159212112 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.159424067 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.179162025 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.179306984 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.331156969 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.331423998 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.350147963 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.350369930 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.505017996 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.505108118 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.521123886 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.521173000 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.676265001 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.676364899 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.692738056 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.692816973 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.847903967 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.850639105 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:08.863722086 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:08.866570950 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.021637917 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.022651911 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.037584066 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.038597107 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.193502903 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.194597960 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.209472895 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.210628033 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.368017912 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.370660067 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.381901979 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.382579088 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.541449070 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.542754889 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.553428888 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.554697990 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.713691950 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.714920998 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.726881981 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.727425098 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.885669947 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.885885954 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:09.900974035 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:09.901077986 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.056798935 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.056935072 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.071980953 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.072076082 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.227772951 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.227968931 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.243041992 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.243138075 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.399029016 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.399234056 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.414022923 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.414138079 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.571146011 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.571244955 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.585099936 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.585166931 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.742182016 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.742280006 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.759368896 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.759471893 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.913182020 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.913283110 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:10.930227041 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:10.930326939 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:11.084191084 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.084347963 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:11.101084948 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.101206064 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:11.255383015 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.255500078 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:11.272157907 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.272260904 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:11.426723957 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.426853895 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:11.443768978 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.443850994 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:11.597954988 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.598069906 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:11.615045071 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.769495964 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.769572020 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:11.943239927 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:11.943347931 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:12.117368937 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:12.117463112 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:12.288338900 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:12.288558006 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:12.459912062 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:12.460026979 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:12.631493092 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:12.631633043 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:12.803145885 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:12.803280115 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:12.974492073 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:12.974613905 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:13.145812988 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:13.145929098 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:13.316860914 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:13.317078114 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:13.488080978 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:13.488342047 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:13.659224033 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:13.659543037 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:13.830475092 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:13.830610037 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:14.001905918 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:14.002006054 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:14.173003912 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:14.173172951 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:14.344629049 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:14.344733000 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:14.518218040 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:14.518311977 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:14.689102888 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:14.689235926 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:14.860110998 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:14.860224009 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:15.032174110 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:15.032275915 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:15.203495026 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:15.203607082 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:15.376075029 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:15.376378059 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:15.547775984 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:15.547967911 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:15.720570087 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:15.720688105 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:15.892047882 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:15.892637014 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:16.063574076 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:16.064723969 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:16.240677118 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:16.240763903 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:16.412055969 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:16.413669109 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:16.585361958 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:16.588984013 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:16.762484074 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:16.764746904 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:16.935913086 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:16.936139107 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:17.107247114 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:17.172470093 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:17.343815088 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:17.343887091 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:17.514931917 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:17.515258074 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:17.686203003 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:17.686317921 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:17.858043909 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:17.858449936 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:18.030298948 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:18.030642033 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:18.201688051 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:18.201967955 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:18.373325109 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:18.373445034 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:18.544586897 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:18.544698954 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:18.718025923 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:18.718264103 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:18.891751051 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:18.891902924 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:19.068007946 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:19.068114042 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:19.239286900 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:19.239432096 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:19.410995007 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:19.411128044 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:19.582309008 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:19.582437992 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:19.754374981 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:19.754574060 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:19.925359011 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:19.925457954 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:20.097706079 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:20.097816944 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:20.268676996 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:20.268884897 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:20.441601992 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:20.441708088 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:20.612618923 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:20.612694979 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:20.783977032 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:20.784090996 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:20.954977036 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:20.958647013 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:21.129512072 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:21.130625963 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:21.301953077 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:21.302643061 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:21.473879099 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:21.474628925 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:21.646311045 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:21.646420002 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:21.818131924 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:21.818641901 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:21.991003036 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:21.991138935 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:22.163156033 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:22.163398981 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:22.334209919 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:22.334314108 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:22.505094051 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:22.602504969 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:22.773382902 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:22.773485899 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:22.944809914 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:22.944906950 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:23.116286039 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:23.116398096 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:23.287426949 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:23.287548065 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:23.458421946 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:23.458542109 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:23.633603096 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:23.633749962 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:23.804759979 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:23.804986954 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:23.981194973 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:23.985120058 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.180771112 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.208353996 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:24.208688974 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.351937056 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:24.353148937 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.380882025 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:24.385196924 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.524230957 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:24.526717901 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.556035042 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:24.558615923 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.697981119 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:24.698079109 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.729597092 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:24.729660988 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.869311094 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:24.869432926 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:24.900691032 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:24.900789022 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.041426897 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.041632891 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.072041035 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.072217941 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.212699890 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.212852001 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.243882895 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.244069099 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.383703947 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.383806944 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.415235996 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.415302038 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.554817915 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.554985046 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.585978985 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.586060047 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.725842953 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.725950956 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.757452011 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.757632971 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.897699118 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.897921085 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:25.928378105 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:25.928448915 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.070005894 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.070208073 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.099858999 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.099927902 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.241597891 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.241697073 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.271326065 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.271533966 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.412859917 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.413033009 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.445291996 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.445493937 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.584661007 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.584929943 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.617692947 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.617785931 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.757045984 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.757342100 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.788676977 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.788925886 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.928383112 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.928688049 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:26.959997892 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:26.960232973 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.103321075 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.103557110 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.142791033 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.143007994 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.276158094 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.276262045 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.319645882 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.319720984 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.448360920 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.448585987 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.494055986 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.494122982 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.628705025 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.628810883 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.669430971 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.669498920 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.800698042 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.800790071 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.840693951 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.840770006 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:27.972213984 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:27.974642038 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.013588905 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.014046907 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.147119045 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.150675058 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.185265064 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.186618090 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.321628094 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.322637081 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.357513905 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.357609034 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.494813919 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.494947910 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.530689955 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.532707930 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.666117907 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.666688919 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.703706026 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.706628084 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.839034081 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.839126110 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:28.877403975 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:28.877465963 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:29.012372017 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:29.013561964 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:29.050633907 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:29.184931993 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:29.185062885 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:29.357548952 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:29.357614994 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:29.528614998 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:29.528708935 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:29.700882912 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:29.700961113 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:29.872297049 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:29.872417927 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.044476032 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:30.046675920 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.217652082 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:30.218748093 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.389746904 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:30.390703917 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.553683996 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.564213037 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:30.564321041 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.725297928 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:30.726660013 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.735878944 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:30.738620043 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.886857986 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.904333115 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:30.904463053 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:30.914798975 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:30.914881945 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.058907032 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.059031963 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.076736927 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.076834917 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.087770939 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.087871075 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.230135918 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.230226040 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.247977018 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.248044968 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.259170055 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.259224892 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.403023958 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.403188944 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.418889046 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.431524992 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.431613922 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.575716019 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.575814962 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.604338884 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.604403019 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.746725082 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.747001886 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:31.776956081 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.917963028 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:31.918023109 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:32.089314938 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:32.089566946 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:32.264045000 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:32.264163971 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:32.438646078 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:32.439893007 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:32.439980984 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:32.610289097 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:32.610415936 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:32.610742092 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:32.779421091 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:32.781627893 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:32.781749964 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:32.950546026 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:32.950655937 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:32.952574015 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:32.952637911 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:33.121994019 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:33.122101068 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:33.123418093 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:33.294066906 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:33.294337034 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:33.465440035 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:33.465584040 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:33.669178009 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:33.677894115 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:33.677968979 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:33.841124058 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:33.841285944 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:33.849435091 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:33.849522114 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.013036013 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.013448954 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.029023886 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.029243946 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.188131094 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.188224077 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.210645914 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.210719109 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.359582901 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.359726906 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.381639957 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.381762028 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.532283068 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.532383919 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.552577019 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.552679062 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.704545021 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.704722881 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.723805904 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.723927975 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.876363993 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:34.876560926 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:34.894825935 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:35.052752018 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:35.053057909 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:35.225234032 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:35.225398064 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:35.396959066 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:35.397135019 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:35.569247007 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:35.569416046 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:35.742151976 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:35.742316961 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:35.914433956 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:35.914542913 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:36.086896896 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:36.087076902 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:36.259524107 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:36.259663105 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:36.430804968 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:36.430911064 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:36.601897955 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:36.602185965 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:36.773464918 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:36.773650885 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:36.945187092 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:36.945379972 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.155232906 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.167963028 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:37.168107986 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.326517105 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:37.326730013 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.340692997 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:37.340840101 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.497751951 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:37.497903109 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.511768103 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:37.511881113 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.669182062 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:37.669295073 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.683720112 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:37.683788061 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.843236923 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:37.843379974 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:37.856044054 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:37.858643055 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:38.014637947 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:38.018872976 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:38.029464006 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:38.030638933 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:38.190320015 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:38.190546036 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:38.201395988 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:38.201756954 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:38.362140894 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:38.364823103 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:38.372924089 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:38.536866903 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:38.538789034 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:38.709830999 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:38.712816954 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:38.884684086 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:38.884815931 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:39.058398962 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:39.058512926 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:39.230998993 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:39.231116056 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:39.402113914 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:39.402221918 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:39.574713945 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:39.574845076 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:39.746305943 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:39.746407032 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:39.917644978 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:39.918663025 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:40.089536905 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:40.090660095 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:40.261842012 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:40.262866974 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:40.434433937 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:40.434593916 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:40.605881929 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:40.606868982 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:40.822813034 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:40.823949099 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:40.998548031 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:40.998697042 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:41.171253920 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:41.267787933 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:41.438662052 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:41.438743114 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:41.609652996 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:41.609822035 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:41.782041073 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:41.782150984 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:41.952927113 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:41.954657078 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:42.125741005 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:42.126707077 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:42.298171043 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:42.298724890 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:42.471506119 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:42.474701881 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:42.677859068 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:42.687827110 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:42.690680981 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:42.851552963 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:42.854680061 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:42.862565994 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:42.862679958 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:43.025930882 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:43.026150942 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:43.034526110 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:43.034621000 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:43.198101997 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:43.198234081 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:43.205419064 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:43.205507994 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:43.370846033 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:43.371059895 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:43.377562046 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:43.544209003 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:43.544433117 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:43.718508005 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:43.718743086 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:43.893249989 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:43.893323898 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:44.064069033 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:44.064196110 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:44.235532045 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:44.235753059 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:44.410248995 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:44.410356045 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:44.587933064 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:44.588052034 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:44.757472038 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:44.760193110 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:44.760276079 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:44.930741072 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:44.933217049 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:44.933901072 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:45.104270935 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:45.104938030 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:45.276053905 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:45.276679039 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:45.481754065 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:45.487838030 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:45.488791943 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:45.652574062 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:45.652973890 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:45.659868002 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:45.661590099 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:45.824377060 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:45.824697971 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:45.832504034 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:45.833213091 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:45.995562077 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:45.995688915 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.004028082 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.004092932 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.166944981 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.167046070 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.174840927 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.174915075 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.337996006 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.338155031 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.345885038 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.345963001 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.509455919 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.509702921 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.517060041 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.517208099 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.680797100 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.680986881 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.690495014 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.690612078 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.852595091 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.852737904 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:46.861352921 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:46.861448050 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:47.026041985 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:47.026225090 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:47.035115004 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:47.035213947 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:47.198174000 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:47.198338985 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:47.206013918 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:47.206109047 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:47.369216919 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:47.369369984 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:47.376702070 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:47.540344954 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:47.540474892 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:47.712157011 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:47.712253094 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:47.883085966 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:47.883203030 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.048455000 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.054267883 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.054478884 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.219649076 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.219841957 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.227315903 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.227390051 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.390850067 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.390955925 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.398416042 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.398478031 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.562310934 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.562465906 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.570161104 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.570228100 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.733206987 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.733331919 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.741380930 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.741453886 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.904184103 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.904340029 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:48.913723946 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:48.913840055 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.075450897 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.075714111 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.084774971 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.084876060 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.249888897 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.249993086 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.258203030 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.258269072 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.424209118 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.424375057 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.431912899 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.432007074 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.595786095 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.595983028 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.607381105 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.607469082 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.768956900 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.769232035 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.782975912 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.783052921 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.941468954 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.941639900 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:49.960024118 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:49.960144043 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.114118099 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.114234924 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.131098986 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.131161928 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.285845041 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.285996914 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.302162886 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.302294016 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.456809998 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.456985950 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.478111029 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.478230953 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.628119946 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.628245115 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.650491953 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.650573015 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.799655914 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.799779892 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.822021008 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.822087049 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.971824884 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.971930027 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:50.993072987 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:50.993160009 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.143862009 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.146708012 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.163918972 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.166687965 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.317744017 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.318687916 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.337526083 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.338675976 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.489727020 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.493201017 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.511163950 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.512681007 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.664328098 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.665261030 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.683830976 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.683921099 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.837707043 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.838669062 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:51.854749918 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:51.855201960 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:52.010149002 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:52.010410070 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:52.027405024 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:52.027616978 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:52.182864904 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:52.182971954 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:52.199100018 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:52.199176073 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:52.354379892 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:52.354500055 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:52.370085955 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:52.526782990 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:52.680342913 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:52.851608992 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:52.851679087 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:53.022799969 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:53.022887945 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:53.194108963 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:53.196687937 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:53.368017912 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:53.368838072 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:53.540122032 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:53.541220903 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:53.731708050 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:53.767873049 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:53.768821955 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:53.905128002 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:53.905270100 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:53.940339088 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:53.940417051 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.079297066 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.079420090 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.111510992 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.111613035 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.251698017 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.251820087 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.283318043 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.283402920 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.422755957 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.422851086 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.454385042 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.454473972 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.593986034 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.594109058 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.625611067 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.625711918 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.765990973 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.766112089 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:54.797061920 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.937309027 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:54.937437057 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:55.109249115 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:55.109379053 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:55.283785105 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:55.283920050 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:55.458221912 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:55.458329916 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:55.630781889 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:55.630888939 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:55.802490950 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:55.802592039 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:55.974292040 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:55.974420071 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:56.145708084 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:56.145859003 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:56.316982985 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:56.318706036 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:56.489844084 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:56.490042925 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:56.718127966 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:56.720748901 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:56.892473936 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:56.892992973 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:57.070285082 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:57.072793961 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:57.244375944 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:57.244873047 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:57.418139935 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:57.418750048 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:57.591875076 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:57.591983080 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:57.762811899 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:57.764853954 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:57.935961962 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:57.936086893 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:58.107156038 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:58.107259989 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:58.278307915 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:58.278434992 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:58.450217009 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:58.450433969 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:58.621619940 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:58.621779919 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:58.792840958 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:58.793015957 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:58.964034081 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:58.964564085 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:59.135663986 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:59.137573957 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:59.308543921 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:59.308794022 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:59.479777098 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:59.481009960 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:59.651949883 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:59.652757883 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:59.823607922 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:59.823726892 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:03:59.994844913 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:03:59.994981050 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:00.166085958 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:00.166372061 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:00.338913918 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:00.339184999 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:00.586313963 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:00.617865086 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:00.617980957 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:00.759294033 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:00.759458065 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:00.791165113 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:00.791337967 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:00.932852030 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:00.933027029 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:00.962203026 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:00.962382078 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:01.104135036 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:01.104240894 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:01.133316040 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:01.133440971 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:01.275324106 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:01.275505066 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:01.304480076 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:01.304646969 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:01.357947111 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:01.358182907 CET	49726	12629	192.168.2.4	18.197.239.5
Mar 24, 2025 05:04:01.529148102 CET	12629	49726	18.197.239.5	192.168.2.4
Mar 24, 2025 05:04:03.474463940 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:03.646393061 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:03.646548033 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:03.658683062 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:03.830332994 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:03.830442905 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:04.002528906 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:04.002768993 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:04.174689054 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:04.175030947 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:04.347373009 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:04.347543955 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:04.521866083 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:04.522094965 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:04.694051027 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:04.694135904 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:04.868370056 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:04.868607044 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:05.040302992 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:05.040394068 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:05.213666916 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:05.213776112 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:05.385904074 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:05.386022091 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:05.558729887 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:05.558867931 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:05.731309891 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:05.731394053 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:05.903099060 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:05.903304100 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:06.075051069 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:06.077555895 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:06.249610901 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:06.250709057 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:06.423429966 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:06.423538923 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:06.595729113 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:06.598705053 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:06.771037102 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:06.773200989 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:06.947122097 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:06.947318077 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:07.120038033 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:07.120271921 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:07.292006969 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:07.292120934 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:07.464478970 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:07.499872923 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:07.671741962 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:07.671818972 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:07.845030069 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:07.845149994 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:08.017070055 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:08.017313957 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:08.189188004 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:08.189344883 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:08.361574888 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:08.361764908 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:08.534060955 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:08.534177065 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:08.706492901 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:08.706715107 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:08.879762888 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:08.880012989 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:09.051856995 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:09.051974058 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:09.224123001 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:09.224241972 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:09.395971060 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:09.396260977 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:09.567889929 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:09.568149090 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:09.740155935 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:09.740232944 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:09.913052082 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:09.913232088 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:10.091187000 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:10.097255945 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:10.274485111 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:10.274679899 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:10.447237968 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:10.447334051 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:10.619633913 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:10.619761944 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:10.791587114 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:10.791699886 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:10.964478016 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:10.964580059 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:11.136145115 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:11.136420012 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:11.310228109 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:11.312937975 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:11.489675999 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:11.493192911 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:11.709352016 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:11.713617086 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:11.888046980 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:11.890734911 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:12.062513113 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:12.062640905 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:12.234508991 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:12.234688044 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:12.406619072 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:12.406758070 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:12.579421997 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:12.579602957 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:12.751487970 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:12.751599073 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:12.923544884 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:12.923644066 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:13.097893000 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:13.098011971 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:13.275486946 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:13.275583982 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:13.455554962 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:13.455645084 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:13.627217054 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:13.627347946 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:13.799269915 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:13.799381018 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:13.971376896 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:13.971478939 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:14.149699926 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:14.152132034 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:14.328610897 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:14.328754902 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:14.500638008 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:14.500745058 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:14.672981024 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:14.673086882 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:14.844938040 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:14.845156908 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:15.016838074 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:15.016990900 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:15.188957930 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:15.189064980 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:15.361032963 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:15.361181974 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:15.532970905 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:15.533107042 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:15.705063105 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:15.705271006 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:15.882967949 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:15.883085966 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:16.054884911 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:16.054977894 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:16.226903915 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:16.227220058 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:16.399686098 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:16.399807930 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:16.577223063 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:16.577482939 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:16.750269890 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:16.750519037 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:16.922792912 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:16.922962904 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:17.094866037 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:17.095038891 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:17.268331051 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:17.268560886 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:17.501394987 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:17.539458990 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:17.539558887 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:17.673285007 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:17.673474073 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:17.711293936 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:17.711484909 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:17.845196962 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:17.845453978 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:17.883631945 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:17.883704901 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.017343044 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.017432928 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.055366993 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.055444002 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.189244986 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.189429998 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.227757931 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.227885962 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.361411095 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.361707926 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.399434090 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.399533987 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.534423113 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.534593105 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.571299076 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.571408987 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.706346035 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.706491947 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.744060993 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.744187117 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.878437996 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.878577948 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:18.916006088 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:18.916361094 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.052261114 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.052362919 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.088301897 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.088412046 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.224927902 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.225183964 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.260442972 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.260515928 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.397795916 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.397952080 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.432476044 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.432636976 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.570656061 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.570777893 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.604758978 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.604849100 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.743325949 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.743438959 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.776985884 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.777116060 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.915199995 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.915292025 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:19.949263096 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:19.949341059 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.088459015 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.088557005 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.121468067 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.121561050 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.262238979 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.262358904 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.293715954 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.293910027 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.435359955 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.435504913 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.467977047 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.468060970 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.607827902 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.607981920 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.639992952 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.640100002 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.781240940 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.781367064 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.812841892 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.812957048 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.954015017 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.954145908 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:20.984833002 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:20.984925985 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.126867056 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.127002954 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.156866074 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.156981945 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.300203085 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.300358057 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.339976072 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.340054035 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.472636938 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.472767115 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.515947104 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.516093969 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.644536972 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.644692898 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.687911034 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.688005924 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.816473007 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.816582918 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.859951019 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.860095978 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:21.988615036 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:21.988713980 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.031804085 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.031881094 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.160597086 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.160712957 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.205423117 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.205514908 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.333045006 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.333148956 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.377141953 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.377286911 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.506031036 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.506122112 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.556564093 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.556864023 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.679925919 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.680035114 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.731193066 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.731271982 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.851676941 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.851937056 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:22.902869940 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:22.902971029 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.023808956 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.023926973 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.074708939 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.074814081 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.195508957 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.195602894 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.248446941 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.248537064 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.368268967 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.368385077 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.422229052 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.422314882 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.541806936 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.541929007 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.593930960 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.594052076 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.713635921 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.713759899 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.765688896 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.765775919 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.885827065 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.885904074 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:23.937539101 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:23.937604904 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.058034897 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.058170080 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.109484911 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.109605074 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.231152058 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.231266022 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.281321049 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.281424046 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.403882027 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.403991938 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.454842091 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.454925060 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.576050997 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.576194048 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.627461910 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.627593040 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.748225927 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.748521090 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.799784899 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.799859047 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.920202971 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.920329094 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:24.971756935 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:24.971862078 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.092192888 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.092302084 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.144118071 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.144205093 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.265496016 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.265630007 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.316351891 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.316453934 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.437221050 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.437319994 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.488177061 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.488271952 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.609272957 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.609369993 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.660259008 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.660386086 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.781056881 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.781172991 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.834757090 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.834820032 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:25.953721046 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:25.953860044 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.006896019 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.006994009 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.126010895 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.126091957 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.190606117 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.190691948 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.301728010 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.301835060 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.371083975 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.371155977 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.484685898 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.484786987 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.543082952 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.543169975 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.657227993 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.657330036 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.715327024 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.715389013 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.829982996 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.830081940 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:26.887326956 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:26.887417078 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.002336025 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.002450943 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.061697006 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.061798096 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.174052000 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.174269915 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.233614922 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.233680964 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.347275972 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.347515106 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.406805992 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.406864882 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.521312952 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.521397114 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.578777075 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.578846931 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.694016933 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.694122076 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.751059055 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.751246929 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.865737915 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.865837097 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:27.922800064 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:27.922971010 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.037853956 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.037966013 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.095285892 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.095383883 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.209765911 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.209899902 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.267549992 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.267654896 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.384756088 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.384834051 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.441329956 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.441402912 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.556698084 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.556804895 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.613482952 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.613586903 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.729762077 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.729878902 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.786237955 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.786318064 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.905567884 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.905751944 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:28.958036900 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:28.958098888 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.077662945 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.077739000 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.129753113 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.129816055 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.249531984 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.249609947 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.301843882 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.301944017 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.429681063 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.429795980 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.480840921 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.480916977 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.606930017 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.607029915 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.658812046 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.658911943 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.779050112 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.779251099 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.842699051 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.842786074 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:29.950887918 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:29.951136112 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.014333963 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.014475107 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.123123884 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.123275995 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.186177015 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.186312914 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.295068979 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.295183897 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.357801914 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.357883930 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.467099905 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.467204094 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.529546022 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.529618979 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.638945103 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.639033079 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.702158928 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.702236891 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.810682058 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.810764074 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.873786926 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.873857975 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:30.987822056 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:30.987921000 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:31.045969009 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:31.046041965 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:31.167840958 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:31.167972088 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:31.220463991 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:31.220536947 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:31.369348049 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:31.369427919 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:31.399763107 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:31.399835110 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:31.541158915 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:31.541280031 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:31.571510077 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:31.712946892 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:31.713083029 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:31.886034012 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:31.886142015 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:32.057950020 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:32.058063984 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:32.229974985 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:32.230103016 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:32.402013063 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:32.402147055 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:32.573827982 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:32.573916912 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:32.745507002 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:32.745625019 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:32.919622898 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:32.919817924 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:33.092968941 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:33.094861984 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:33.266336918 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:33.266527891 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:33.439423084 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:33.439502001 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:33.612256050 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:33.612541914 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:33.784195900 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:33.786755085 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:33.958941936 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:33.962764025 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:34.134756088 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:34.134902954 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:34.308691025 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:34.308782101 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:34.480618954 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:34.480751038 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:34.652403116 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:34.823904037 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:34.996529102 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:34.996649981 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:35.168893099 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:35.169020891 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:35.343969107 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:35.344312906 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:35.519232035 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:35.519452095 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:35.691679955 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:35.691759109 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:35.863384962 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:35.863478899 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:36.040796995 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:36.041125059 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:36.216003895 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:36.216238976 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:36.389337063 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:36.389667034 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:36.563864946 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:36.563977003 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:36.781718969 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:36.792164087 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:36.792273045 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:36.955391884 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:36.955534935 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:36.966526985 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:36.966603994 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.127244949 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.127355099 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.138406038 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.138478041 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.301640987 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.301722050 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.315615892 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.315674067 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.473407030 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.473624945 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.488044977 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.488229036 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.645508051 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.645591021 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.660078049 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.660137892 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.818320990 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.818435907 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.833825111 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.833887100 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:37.990725994 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:37.990859032 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.005676985 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.005742073 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.164186001 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.164305925 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.177581072 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.177745104 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.336909056 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.337028980 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.349658012 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.349730968 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.508579969 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.508701086 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.521337986 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.521433115 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.681080103 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.681320906 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.693212986 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.693300009 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.854139090 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.854226112 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:38.864866972 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:38.864919901 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:39.026354074 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:39.026427984 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:39.038834095 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:39.200006962 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:39.200166941 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:39.372124910 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:39.372258902 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:39.544511080 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:39.544619083 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:39.716687918 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:39.716808081 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:39.889045954 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:39.889141083 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:40.061309099 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:40.061434984 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:40.233326912 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:40.233510017 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:40.406692028 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:40.406811953 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:40.578767061 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:40.578907013 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:40.759488106 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:40.759629011 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:40.935482025 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:40.935615063 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:41.109776020 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:41.109863043 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:41.282416105 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:41.282507896 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:41.485131979 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:41.509486914 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:41.509620905 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:41.658258915 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:41.658411026 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:41.687639952 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:41.687709093 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:41.830768108 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:41.830857992 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:41.859502077 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:42.002724886 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:42.006736994 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:42.179177046 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:42.215476990 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:42.386998892 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:42.387078047 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:42.561463118 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:42.561558962 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:42.735218048 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:42.735336065 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:42.908452034 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:42.908788919 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:43.081078053 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:43.081197023 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:43.253088951 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:43.253185034 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:43.425007105 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:43.426872015 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:43.599929094 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:43.602794886 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:43.774629116 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:43.774807930 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:43.946614027 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:43.946696043 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:44.119040012 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:44.119165897 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:44.290971041 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:44.291062117 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:44.463963985 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:44.464092016 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:44.636053085 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:44.636313915 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:44.808022022 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:44.808247089 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:44.980133057 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:44.980274916 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:45.153963089 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:45.154181004 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:45.326915026 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:45.327122927 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:45.498960018 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:45.499217987 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:45.672983885 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:45.673120022 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:45.847328901 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:45.847455025 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:46.021095037 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:46.021194935 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:46.196049929 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:46.196480989 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:46.368347883 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:46.369771004 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:46.541521072 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:46.545780897 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:46.717807055 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:46.720952034 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:46.892713070 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:46.893752098 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:47.065648079 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:47.065895081 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:47.237692118 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:47.237931013 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:47.410226107 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:47.410310030 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:47.582509041 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:47.582636118 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:47.754216909 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:47.754313946 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:47.926326036 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:47.926410913 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:48.098490000 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:48.098660946 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:48.270406961 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:48.270672083 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:48.487448931 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:48.509605885 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:48.509686947 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:48.659890890 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:48.659987926 CET	49727	12629	192.168.2.4	18.157.68.73
Mar 24, 2025 05:04:48.681370974 CET	12629	49727	18.157.68.73	192.168.2.4
Mar 24, 2025 05:04:48.832737923 CET	12629	49727	18.157.68.73	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 05:00:51.805017948 CET	58037	53	192.168.2.4	1.1.1.1
Mar 24, 2025 05:00:51.905003071 CET	53	58037	1.1.1.1	192.168.2.4
Mar 24, 2025 05:01:55.170331955 CET	50791	53	192.168.2.4	1.1.1.1
Mar 24, 2025 05:01:55.269308090 CET	53	50791	1.1.1.1	192.168.2.4
Mar 24, 2025 05:02:59.170476913 CET	63297	53	192.168.2.4	1.1.1.1
Mar 24, 2025 05:02:59.298784018 CET	53	63297	1.1.1.1	192.168.2.4
Mar 24, 2025 05:04:03.373090982 CET	65318	53	192.168.2.4	1.1.1.1
Mar 24, 2025 05:04:03.472974062 CET	53	65318	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 24, 2025 05:00:51.805017948 CET	192.168.2.4	1.1.1.1	0xcecb	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Mar 24, 2025 05:01:55.170331955 CET	192.168.2.4	1.1.1.1	0x1061	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Mar 24, 2025 05:02:59.170476913 CET	192.168.2.4	1.1.1.1	0xdc9d	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Mar 24, 2025 05:04:03.373090982 CET	192.168.2.4	1.1.1.1	0x84f2	Standard query (0)	2.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 24, 2025 05:00:51.905003071 CET	1.1.1.1	192.168.2.4	0xcecb	No error (0)	2.tcp.eu.ngrok.io	18.156.13.209	A (IP address)	IN (0x0001)	false
Mar 24, 2025 05:01:55.269308090 CET	1.1.1.1	192.168.2.4	0x1061	No error (0)	2.tcp.eu.ngrok.io	3.127.138.57	A (IP address)	IN (0x0001)	false
Mar 24, 2025 05:02:59.298784018 CET	1.1.1.1	192.168.2.4	0xdc9d	No error (0)	2.tcp.eu.ngrok.io	18.197.239.5	A (IP address)	IN (0x0001)	false
Mar 24, 2025 05:04:03.472974062 CET	1.1.1.1	192.168.2.4	0x84f2	No error (0)	2.tcp.eu.ngrok.io	18.157.68.73	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

• #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe
• netsh.exe
• conhost.exe

Click to jump to process

Memory Usage

• #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe
• netsh.exe
• conhost.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry
• Network

Click to dive into process behavior distribution

Behavior

• #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe
• netsh.exe
• conhost.exe

Click to jump to process

Target ID:	0
Start time:	00:00:42
Start date:	24/03/2025
Path:	C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe"
Imagebase:	0x480000
File size:	37'888 bytes
MD5 hash:	24AB0BA0700AFF18D46F4B4858907567
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.1180996745.0000000000482000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:00:49
Start date:	24/03/2025
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" "#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe" ENABLE
Imagebase:	0xe30000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:00:49
Start date:	24/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage

Dynamic/Packed Code Coverage

Signature Coverage

Execution Coverage:	17.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.1%
Total number of Nodes:	163
Total number of Limit Nodes:	7

Executed Functions

Function 00A4B3AF Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00A4B42F

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: e43a59fda83be4d3bbf420703d25eef3248075a5a160fc36d5255a7c9179f101
Instruction ID: 8f4b0203fa4aa27e1101adf04bebabb8877c342d10c013eceed3d30d7bf932b6
Opcode Fuzzy Hash: e43a59fda83be4d3bbf420703d25eef3248075a5a160fc36d5255a7c9179f101
Instruction Fuzzy Hash: 0F21AD755097809FEB228F25DC44B52BFF4EF16310F09849AE9858B163D234E918DB62

Function 00A4B3E6 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00A4B42F

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 121025505d4a5e1e792ccddcd3f87454244f7e7cdc39efbcbc0199e5bfd9c45e
Instruction ID: e167cac4233f4bdbc0532ed96fdc91d2f06bff92054cadc0793da6138ae274b4
Opcode Fuzzy Hash: 121025505d4a5e1e792ccddcd3f87454244f7e7cdc39efbcbc0199e5bfd9c45e
Instruction Fuzzy Hash: 7B1182799006009FEB20CF55D844B66FBE4EF44720F08C4AADD468B662D335E414DF72

Function 00A4B714 Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL ref: 00A4B771

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 749f7899464d97711cbbe96eb814ac0f4f3ee2aad94a00431970a93b82486579
Instruction ID: e7aae7979727a05839a194d0ec640c46d0c1f111641130439e295c3732856652
Opcode Fuzzy Hash: 749f7899464d97711cbbe96eb814ac0f4f3ee2aad94a00431970a93b82486579
Instruction Fuzzy Hash: 5411A075409780AFDB228F11DC44E62FFF4EF46320F09849AED854B262D275A818CB62

Function 00A4B736 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL ref: 00A4B771

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: InformationProcess
String ID:
API String ID: 1801817001-0
Opcode ID: 379e51f12e4a4d008207ca01eff09df83c9c29c4f3cf817cf9ec1f445cfa0eb7
Instruction ID: 41f83efb5db5308c5db216d1c58c9bbb2ae5800db1837e5e31eb0569bd5252c0
Opcode Fuzzy Hash: 379e51f12e4a4d008207ca01eff09df83c9c29c4f3cf817cf9ec1f445cfa0eb7
Instruction Fuzzy Hash: C2018B398146009FEB208F15D984B62FBE0EF88720F08C49ADE494B262D375E418DBB2

Function 00F40F90 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00F40FB7

Memory Dump Source

Source File: 00000000.00000002.3635067209.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: acea4c9e563a08b37ec2229a641a917ac782f1d6059e966280a8b780f2f1dece
Instruction ID: 3229f1dc9fe256eab3dfa27c2a793ade27ec375274db3d188d8b600f9da56dd9
Opcode Fuzzy Hash: acea4c9e563a08b37ec2229a641a917ac782f1d6059e966280a8b780f2f1dece
Instruction Fuzzy Hash: DF41B331A002118FDB14EF79C88466DB7E6EF88214B148079D909DB299DF34CD86CBA0

Function 00F40F7F Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 00F40FB7

Memory Dump Source

Source File: 00000000.00000002.3635067209.0000000000F40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f40000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b6a60354d132f41391f0144eb9613a9c71e951a721498a8322ba670413bcb8d1
Instruction ID: 64c94dbac9eed0664a1939f7f14b911a8ab452584ea6b2e791f30e9f6b668f95
Opcode Fuzzy Hash: b6a60354d132f41391f0144eb9613a9c71e951a721498a8322ba670413bcb8d1
Instruction Fuzzy Hash: 11418231A002418FDB14DF79C89466E7BF2EF88314B148079D809DB29AEB35CD86DBA0

Function 00F8038E Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 00F8044D

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4c6061eae41ab0a95b93092a8c218cfda1b87965d5afe93dc24a2ee718799d80
Instruction ID: 938d961696752cf2ee68a4b1394df87fc073de51484fc1433b0dbac8865d9fd4
Opcode Fuzzy Hash: 4c6061eae41ab0a95b93092a8c218cfda1b87965d5afe93dc24a2ee718799d80
Instruction Fuzzy Hash: 79319271504380AFE722CF25DC45FA2BFF8EF06314F09889AE9858B252D775A909DB71

Function 00F8290A Relevance: 1.6, APIs: 1, Instructions: 99
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 00F829D1

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8fa19a51d96c44a15b8d0ce6afe8b146ce8d6b3123650861c872b83e05468341
Instruction ID: b300a4d3399fac8775be54106d71c978f2fe29433adf3529db6b7ac41ac53a58
Opcode Fuzzy Hash: 8fa19a51d96c44a15b8d0ce6afe8b146ce8d6b3123650861c872b83e05468341
Instruction Fuzzy Hash: DA315E76504744AFE721CF65CC44FA7BBECEF05324F08859AE9858B152D364E908DB61

Function 00F808FB Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 00F809C2

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0d42f8c0de3e29a69b6695ed718f6eea9e530dff2eea8636c0556747b563d55c
Instruction ID: b73fb04e47fba1ee74ebef53a14a398616d27b4d714e523dca51e1d6c44da7d3
Opcode Fuzzy Hash: 0d42f8c0de3e29a69b6695ed718f6eea9e530dff2eea8636c0556747b563d55c
Instruction Fuzzy Hash: CC319C7510E3C06FD3139B218C61A61BFB4EF47610B0E45CBD8C48F6A3D229A809D7B2

Function 00F81528 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 00F815EF

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 1d241addd6f17f3d24abcad9be8efa71393285444035d8099c93d12d37ed8e7e
Instruction ID: e9a9b284d3264250826c52912eab129e53020f7bfd31b2ea3bf4e17c0a65c519
Opcode Fuzzy Hash: 1d241addd6f17f3d24abcad9be8efa71393285444035d8099c93d12d37ed8e7e
Instruction Fuzzy Hash: 8531C2B2404344AFEB21CF51CC84FA6FBACEF04314F04489AFA489B192D3B4A909CB71

Function 00A4AA52 Relevance: 1.6, APIs: 1, Instructions: 91registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 00A4AB05

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: fd99dd0c0b912b3d06fc8eeb110f575a3dc9c37c1c15416ac1cd9de25480f445
Instruction ID: 0834b8d0616ed85e9c4def8eae06457997d6b3f4f94f9d534f14c715872d03ab
Opcode Fuzzy Hash: fd99dd0c0b912b3d06fc8eeb110f575a3dc9c37c1c15416ac1cd9de25480f445
Instruction Fuzzy Hash: 6F3187764083846FE7228B51CC44FA7BFBCEF16314F09859AE985CB153D364A909C772

Function 00F81420 Relevance: 1.6, APIs: 1, Instructions: 90timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F814BD

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 6b6d4b8d0528c322c056d10b0949ef91a75a102829ddbd896d189d7aa50a397d
Instruction ID: 66c9e3e434ab8470aae06be2fef0af9e62a3bbe6a4b81c04ecd1daf1500bfda4
Opcode Fuzzy Hash: 6b6d4b8d0528c322c056d10b0949ef91a75a102829ddbd896d189d7aa50a397d
Instruction Fuzzy Hash: F831F7B65093805FEB128F61DC45FA6BFB8EF06324F09849AE9858F193D2259909C761

Function 00A4A612 Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 00A4A6B9

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 0f7ca762c586c3c2b34570c21047a99764a299aa71233f04d8a2c8dbff4085d3
Instruction ID: 34d89cfb51a9004b184dc8bc01ab9a3ce03ca63f111663315a653991032b8d7b
Opcode Fuzzy Hash: 0f7ca762c586c3c2b34570c21047a99764a299aa71233f04d8a2c8dbff4085d3
Instruction Fuzzy Hash: 203181755093805FE721CB25CC85B96BFF8EF16314F09849AE944CF292D375A909C762

Function 00F80E14 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 00F80EAB

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 49895af1386a5af2ad2135fc20ada58cfea50ae9e671c2a83230eff33a182681
Instruction ID: edbb058302a7bae56c0be22cf6a9af3ab5ea5b09973d442bfff685067c17bee9
Opcode Fuzzy Hash: 49895af1386a5af2ad2135fc20ada58cfea50ae9e671c2a83230eff33a182681
Instruction Fuzzy Hash: 4C318176508384AFEB21CB65DC45FA7BBE8EF05320F09889AE945CB152D774A908CB61

Function 00A4B61C Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00A4B6B0

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 9d222807c918e519bbddcf1cde1376ec083198860112d3b1439eb2e0dd93f951
Instruction ID: bd32ef6564794dee904bbb22df50e71dd9d4d8fa30b1abdb9ac9dc7516fc6c03
Opcode Fuzzy Hash: 9d222807c918e519bbddcf1cde1376ec083198860112d3b1439eb2e0dd93f951
Instruction Fuzzy Hash: 9321D3764097805FE7128B25DC45BA6BFB8EF46324F0984DAE984CF193D264A909CB61

Function 00F82936 Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNEL32(?,00000E24), ref: 00F829D1

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8e6c704fa964689035e34f88b8abd46bb263b436f84f1679562ed074a01f4449
Instruction ID: bd71511e1c32a5335e21c83067c196b9389fa76bfe91ecf8d457ce4562226f9c
Opcode Fuzzy Hash: 8e6c704fa964689035e34f88b8abd46bb263b436f84f1679562ed074a01f4449
Instruction Fuzzy Hash: C421A076500604AFEB30DE15CC84FA7BBECEF08324F04885AEA45C7252E364E9089BB1

Function 00A4A361 Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00A4A40C

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1791693e0e124c79064130a592876dc10a29787feb1adea263f7351adf0b0054
Instruction ID: 852f55e52c67ab278ebb1501998fb36260f5cfe4ee14c0b2f7e9b3da9d5f6d85
Opcode Fuzzy Hash: 1791693e0e124c79064130a592876dc10a29787feb1adea263f7351adf0b0054
Instruction Fuzzy Hash: 9F318179509740AFE721CF11CC84F67BBF8EF55710F09849AE945CB192D364E909CB62

Function 00F82C78 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F82D0F

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: eea8d60ee9451d5d4f1eadcc3c3d375bf0756c958de8377b121033e878ad06c9
Instruction ID: a1b53c55ecae5acb00708a3f149e77393ded51a9791104af3de849aeb5e59482
Opcode Fuzzy Hash: eea8d60ee9451d5d4f1eadcc3c3d375bf0756c958de8377b121033e878ad06c9
Instruction Fuzzy Hash: FE21A7764093C05FE712CB20DC55BA6BFB8EF46324F0984DAE9488F193D265A909C761

Function 00F8154A Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 00F815EF

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 0745e559f4a12c385f3c955a4321f3c77555c8ecd5853b898ea595103f5e6da0
Instruction ID: 7aa0fc4d459abe039478c43f7dbe894b6dcd4f7dbeda684acda9b5542761fc8c
Opcode Fuzzy Hash: 0745e559f4a12c385f3c955a4321f3c77555c8ecd5853b898ea595103f5e6da0
Instruction Fuzzy Hash: 3A21A3B1504204AEFB30DF51CC85FA6F7ACEF04714F14895AFA499B181D7B4A9098BB5

Function 00F8189C Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 00F81942

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 6f94c5cc4b1236c5dcb8d120dba228724513080c730283dc78c44a91e35035c5
Instruction ID: 84e14cff1aa6c96d3682d7b9049c46aca7ddeb9c49caa2706d79d316d654599d
Opcode Fuzzy Hash: 6f94c5cc4b1236c5dcb8d120dba228724513080c730283dc78c44a91e35035c5
Instruction Fuzzy Hash: 8831917150D3C06FD3138B258C55B62BFB8EF47610F0A80DBE884CF693D225A948C7A2

Function 00F82BA9 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 00F82C38

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 56ce5619fe436cd97c3d94cceffcfd9662e26b8625b3c75674891ba5877c2a37
Instruction ID: 3c121ce1f7bf7fa3d2983ef686ae222a475701fc85cb71806acfa3a998a1b75d
Opcode Fuzzy Hash: 56ce5619fe436cd97c3d94cceffcfd9662e26b8625b3c75674891ba5877c2a37
Instruction Fuzzy Hash: DE216F755043809FDB22CF25CC44BA6BFF8EF06324F0984DAE984CB262D365A908DB61

Function 00F804A4 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F80539

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: fa3c8d2369f5e4f8accc0c90cfdf01aa80f464a76da970f5265bb847d10e785d
Instruction ID: 6e25106a36d019e4d702e905d11e164c495036d59b5863a497b301be1ede2ed8
Opcode Fuzzy Hash: fa3c8d2369f5e4f8accc0c90cfdf01aa80f464a76da970f5265bb847d10e785d
Instruction Fuzzy Hash: 1D210A754097806FE7128B21DC45BA2BFBCEF47724F0984DAE9858F193D264A909C7B1

Function 00A4A462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00A4A4F8

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7c99f6ece78be8999d710ca5702ae251e53bad24c41e7a2e59440f495bc31db8
Instruction ID: 96ad90c15ceeae1c8ce1e81d4957f1759bd5ac1b74ca80e5f696cba998a13932
Opcode Fuzzy Hash: 7c99f6ece78be8999d710ca5702ae251e53bad24c41e7a2e59440f495bc31db8
Instruction Fuzzy Hash: 4C2192765083806FE7228F11DC44F67BFB8EF55714F08849AE985CB252D264E908CB72

Function 00F809EE Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00F80A7A

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 25713c8f0c996c27abf5f4100ea75f8935b68eca1a7faa66bedc5ea2ea6fc5f7
Instruction ID: c0a92e8ad6d68a26973d10cf60fccc9c7efdf51736d921047aff32836efa27c2
Opcode Fuzzy Hash: 25713c8f0c996c27abf5f4100ea75f8935b68eca1a7faa66bedc5ea2ea6fc5f7
Instruction Fuzzy Hash: 04215E75409380AFE721CF55DC45FA6FFF8EF05324F08889AE9858B292D375A508CB61

Function 00F80FCA Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 00F8105E

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: b7f5939ae250901f6f887dc87ce28484e7d57ff4423cce8c0c1d5d0e3a78f9dc
Instruction ID: ccd505e55a2fb6f72e5c8fa56aa174efbabf72686884dd1ec31e0925ec09f157
Opcode Fuzzy Hash: b7f5939ae250901f6f887dc87ce28484e7d57ff4423cce8c0c1d5d0e3a78f9dc
Instruction Fuzzy Hash: FD218271409380AFE721CF55CC45FA6FBF8EF09324F04899EE9858B192D375A549CB61

Function 00F803CE Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 00F8044D

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cf69d579e86f71b97a38f7e1091bf7561b06c44643fd72866a9a0fb494fba1b1
Instruction ID: 702a11a468b4e492b1948e1c94ce7ba030471cfeaeea427c02d52060a8164b23
Opcode Fuzzy Hash: cf69d579e86f71b97a38f7e1091bf7561b06c44643fd72866a9a0fb494fba1b1
Instruction Fuzzy Hash: 9D21B675904200AFEB20DF65DD45FA6FBE8EF08324F04886DEA458B291D771E508DB71

Function 00F80E3A Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 00F80EAB

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: ad3d46d01491c47e3f61fcd9f0daee66cd8386fa6dd172e275a08da195d49720
Instruction ID: 02ad2e1d021324f509d97d52da8f5b9c934b48b00718d325ac9c0ddc1879df9f
Opcode Fuzzy Hash: ad3d46d01491c47e3f61fcd9f0daee66cd8386fa6dd172e275a08da195d49720
Instruction Fuzzy Hash: 53219576504204AFEB20DE25DC45FABB7ECEF04714F14885AEA45CB241D774E9089BB5

Function 00F80D22 Relevance: 1.6, APIs: 1, Instructions: 76registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F80DC0

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 76f95bc92835e3b616587c080ec34700798b870fecb586aaa4c8c58b9de59fe4
Instruction ID: 84d3fee736276965ed93b03f8cfcc9ac7917c28abb06f96c8e6842924c519dca
Opcode Fuzzy Hash: 76f95bc92835e3b616587c080ec34700798b870fecb586aaa4c8c58b9de59fe4
Instruction Fuzzy Hash: 0E21A376504740AFE721CF51CC44FA7BBF8EF45320F08849AE9458B192D724E908C761

Function 00A4AA86 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000E24), ref: 00A4AB05

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2838799b42361155e904bd0ba9c816c8b9dde5b360967e6bf614d86956195952
Instruction ID: 32e5469e46f80e00006ebd6e2e6c602ac02a448c0d5411341d7347e7214fceed
Opcode Fuzzy Hash: 2838799b42361155e904bd0ba9c816c8b9dde5b360967e6bf614d86956195952
Instruction Fuzzy Hash: BC21A476504204AEE7209F11CC45FABF7ECEF54314F14845AEA458B251D774E909CAB2

Function 00F82D77 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F82DF3

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 95c93d80cda9a47aaef6eb2684c0c217b1591dcfbe2650b3cd9467e537e3d162
Instruction ID: da40cc33c882b4299acfaa4a6bb0edde55c24fd1136b4a241e04c93652d3ea2e
Opcode Fuzzy Hash: 95c93d80cda9a47aaef6eb2684c0c217b1591dcfbe2650b3cd9467e537e3d162
Instruction Fuzzy Hash: 7021A4765093806FEB21CF11DC49FA7BFB8EF45324F08849AE945DB192D374A904CBA5

Function 00A4A646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 00A4A6B9

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 3439270c7d7d8319d3fe28a5f7adc88f87930a97ce4f587b8dc4c65cf8cbf47d
Instruction ID: 8c380eb951873c4117837834c2b5e5d980c02f2576955143ac2976b811e42815
Opcode Fuzzy Hash: 3439270c7d7d8319d3fe28a5f7adc88f87930a97ce4f587b8dc4c65cf8cbf47d
Instruction Fuzzy Hash: D721A479504240AFF720CF25CD85BA6FBE8EF54314F098869EA49CF281D775E905CAB2

Function 00F81261 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F812E4

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 735800829b4a3de922d26d4ca0e1211b0b23fe8e141db897f84af52502b0a31e
Instruction ID: 78d6cf8036fa26e262fcccb9afa5f3bf1d6d5d936416e7c45a9373d9bd5fa6e6
Opcode Fuzzy Hash: 735800829b4a3de922d26d4ca0e1211b0b23fe8e141db897f84af52502b0a31e
Instruction Fuzzy Hash: 4C219575409380AFE7228B11CC45BA6FFB8EF46324F0985DBE9449F152D364A544C761

Function 00A4B0F7 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00A4B16E

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 9928f462f07fa734fda05d44e7b9cb7a6f09bac9c0d840c92597eb875b8d82b3
Instruction ID: 7a5ec0915ee7b5fbdb40100c1d4835377e2e05b227a9f715275ef5e64dbea6f9
Opcode Fuzzy Hash: 9928f462f07fa734fda05d44e7b9cb7a6f09bac9c0d840c92597eb875b8d82b3
Instruction Fuzzy Hash: 952184755083805FEB21CF29DC54B52BFF8EF56610F0884DAED85CB252D265E804D771

Function 00F80786 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F80805

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 81efcd0516748a3c84bfdc319614ddc16237baecdacd6f38d00789c85cf4153c
Instruction ID: e2832ff362ae2c586b7a3b169fce03ad9c390e8a15840be29ac148796ac44ab0
Opcode Fuzzy Hash: 81efcd0516748a3c84bfdc319614ddc16237baecdacd6f38d00789c85cf4153c
Instruction Fuzzy Hash: E3219276409780AFEB22CF51DC44FA7BFB8EF45324F08849AE9498B152C374A508CBB1

Function 00A4A392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00A4A40C

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: c127063500531b08a146884ec0fe4ded29e4d0e8e4451069f1d75c002f706475
Instruction ID: 448a832d743d178426b38b7021fd09506e6bdd196f302ade08dd628109428c41
Opcode Fuzzy Hash: c127063500531b08a146884ec0fe4ded29e4d0e8e4451069f1d75c002f706475
Instruction Fuzzy Hash: 73219079644604AFEB20CF15CC88F67F7ECEF54714F18845AE946CB291D760E905CAB2

Function 00F82AE3 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F82B5F

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 77ce9a6eb2414f297fa271290a72ac242c5bd2994cdcf03bd9309454aecaab84
Instruction ID: 951fe67e1950ea41cf5ae5f06268f12913b1caf25654c31c33cd44a875197ea4
Opcode Fuzzy Hash: 77ce9a6eb2414f297fa271290a72ac242c5bd2994cdcf03bd9309454aecaab84
Instruction Fuzzy Hash: EE21C6754093806FE721CF51CC49FA6FFB8EF45314F08849BE9459B152D374A504C7A1

Function 00F816FA Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 00F81776

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: ea99dd282fe46e113e5122676bf4d9a0ebf778484fddebfbd5a866b388e8b99c
Instruction ID: 38ce321a11c30b4ea7d72df1fa49297f6f87d44b6aa1cbe94b82d50dda8fbc4a
Opcode Fuzzy Hash: ea99dd282fe46e113e5122676bf4d9a0ebf778484fddebfbd5a866b388e8b99c
Instruction Fuzzy Hash: 8B216275408380AFDB228F55DC44B56BFF8FF06310F0985DAE9858B263D375A819DB61

Function 00F80FEA Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 00F8105E

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 6774c59656d2a508538f7d27f8a1237315c7eb8abc1c87112b45d019b8413d7f
Instruction ID: 63283a5ab23e851aea3157824692d20d0f9c4e69b7ca52a98257b9618f8ada81
Opcode Fuzzy Hash: 6774c59656d2a508538f7d27f8a1237315c7eb8abc1c87112b45d019b8413d7f
Instruction Fuzzy Hash: EA21A175404244AFEB21DF15CC85FA6FBE8EF08324F048959EA458B291D375A549CBA2

Function 00F80A0E Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 00F80A7A

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: b154470f1cf012c38c44a31617e70eee52984efe161f8c3b4af4dbf58c976130
Instruction ID: 46e75ccd94740f7533d5bb66448a0166aac937b937f94d21cee9797814522ca8
Opcode Fuzzy Hash: b154470f1cf012c38c44a31617e70eee52984efe161f8c3b4af4dbf58c976130
Instruction Fuzzy Hash: EF21D172404200AFEB21DF51CC45FA6FBE8EF08324F04885AEA458B291D775A408DBB2

Function 00F81B5E Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 00F81BE7

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5aba780d4272efaaf6fcadf2a30c931a4d519d276737d019dfc6f11aaaf902e7
Instruction ID: 98c30ed346c3862f7a573859733e8fa57133304b49992d30b3c21114e7defe1a
Opcode Fuzzy Hash: 5aba780d4272efaaf6fcadf2a30c931a4d519d276737d019dfc6f11aaaf902e7
Instruction Fuzzy Hash: DE11D675449340AFE721CB11DC85FA6FFBCEF45720F08849AF9489B192D374A948CBA5

Function 00A4A486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00A4A4F8

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: c37c19972fe4fb580b118a5abadc9d7022114f5ddf5f43573a529b28e9db292b
Instruction ID: 831f1fdec9cb3db7393ce0983ed6f1e6aeacaf88e3988e42df2ef48330ff792b
Opcode Fuzzy Hash: c37c19972fe4fb580b118a5abadc9d7022114f5ddf5f43573a529b28e9db292b
Instruction Fuzzy Hash: 7F11B1BA504600AFEB208F11CC45F67FBECEF54714F04845AED458B681D360E804CAB2

Function 00F80D4E Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F80DC0

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1c66d02b274c643fd70cfe2ff104507ac1eec29e7571185118872cb1f9ab999a
Instruction ID: 7d9d4965272cdfaa7d14ef1d8cd26de904188b58ca1d37b8a0981806dc0f56c8
Opcode Fuzzy Hash: 1c66d02b274c643fd70cfe2ff104507ac1eec29e7571185118872cb1f9ab999a
Instruction Fuzzy Hash: 61117C76904600AFEB71DE55CC45FA7F7E8EF04724F08845AEA458B291DB60E908DBB1

Function 00F8145E Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F814BD

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 4ffcfadb9846cad72b53f50a49a30232d709b6a2385463767b89b84c29480d1d
Instruction ID: 77507459b36c9af4f07b05e6a0746cfb98b042c494f431e02b3ec3a1edd242e3
Opcode Fuzzy Hash: 4ffcfadb9846cad72b53f50a49a30232d709b6a2385463767b89b84c29480d1d
Instruction Fuzzy Hash: 7211D376504200AFEB21CF51DC45BA6F7ECEF04324F18895AEA46CB251D774A4049BB1

Function 00F82CB6 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F82D0F

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 52190c175c58dd6c49c25be03ecea708c3eda8766aaa88c23f144b5ad4fa7636
Instruction ID: d9f7cb83b305926371fce0a7397ebced6842091210b5a73679531dc7546e04aa
Opcode Fuzzy Hash: 52190c175c58dd6c49c25be03ecea708c3eda8766aaa88c23f144b5ad4fa7636
Instruction Fuzzy Hash: E911E776504200AFFB21DF15DC45BA6FBE8EF04724F18846AEE09CB251D774A504DBB5

Function 00F81AA9 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CoGetObjectContext.COMBASE(?,?), ref: 00F81B1B

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 02ec1301c55fed99e7df55986b4c947f454b80a0d86f429eb939f455eeeab92a
Instruction ID: 5099577c9e5017381286c605787f3b1e27d03c1b2d1ec45bb5b470e59a373f36
Opcode Fuzzy Hash: 02ec1301c55fed99e7df55986b4c947f454b80a0d86f429eb939f455eeeab92a
Instruction Fuzzy Hash: 972190754087809FDB128F25CC49B51FFB4EF46320F0981DEDD854F2A3E265A91ADB61

Function 00F82D9A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F82DF3

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 52190c175c58dd6c49c25be03ecea708c3eda8766aaa88c23f144b5ad4fa7636
Instruction ID: 24c4a9d90cb36008be680a261d63fde7b043c1b2e76391f0cd026180554e8c46
Opcode Fuzzy Hash: 52190c175c58dd6c49c25be03ecea708c3eda8766aaa88c23f144b5ad4fa7636
Instruction Fuzzy Hash: A711C476504200AFEB20DF15DC85BAAF7E8EF04324F14846AEE05CB281D774A5049BB5

Function 00A4B65A Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00A4B6B0

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 1c96af7511e78d0eb5bf3f81b49e3c6fcdb1764a34597ba1cee965c40607b3ea
Instruction ID: 6631b274cce6ca6a9faa32d7c7ca2017f8986d9133feb0c2326b24d2865a7daa
Opcode Fuzzy Hash: 1c96af7511e78d0eb5bf3f81b49e3c6fcdb1764a34597ba1cee965c40607b3ea
Instruction Fuzzy Hash: 1A11A379504200AFFB208F15DC45BAAF7E8EF44724F15886AEE05CB281D774E9048AB5

Function 00F807A6 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F80805

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 3f9ea5afbbf7ac67a38886e8e437b647cc84372905ac4923b52da0e0bab1b6f8
Instruction ID: 039d9ae8878adea42c810a23d57cd93c1c64f8d49efd21920d1f96163e269ba5
Opcode Fuzzy Hash: 3f9ea5afbbf7ac67a38886e8e437b647cc84372905ac4923b52da0e0bab1b6f8
Instruction Fuzzy Hash: 9D11E776404600AFEB21DF51DC44FAAFBE8EF04724F14885AEE498B251C774A548DBF1

Function 00F82B06 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F82B5F

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 6beb311860f9d82a7b50c4af21d4cf67579e15376e0ff986009c4c4a0cbae4d0
Instruction ID: d5eb75bf0cbd4c3aa862eb6676f77ff75e0e1425d32a1da8a61490a98faf65bd
Opcode Fuzzy Hash: 6beb311860f9d82a7b50c4af21d4cf67579e15376e0ff986009c4c4a0cbae4d0
Instruction Fuzzy Hash: AD11E376405200AFEB20DF11CC85FA6F7E8EF44324F18885AEE058F241D374A5049BB5

Function 00F8128E Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F812E4

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 5ccbe603b818b32bd708decc11a3377e5eb8c89c7c4e715563a63036e2a58671
Instruction ID: e915aa5942faa99831ccfe745c078308a96616a60c9b8c074b9c3ef8fcb17621
Opcode Fuzzy Hash: 5ccbe603b818b32bd708decc11a3377e5eb8c89c7c4e715563a63036e2a58671
Instruction Fuzzy Hash: 6611A075904204AFFB219F11DC45BAAB7ECEF04724F1884AAEE059B241D674A5058BB5

Function 00A4A2D2 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,5E6642BF,00000000,?,?,?,?,?,?,?,?,6D073C58), ref: 00A4A330

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6ef21f686a7c36c70eb70e59589049d029fcb9f1b7522ef2f7c9dea64f9488e1
Instruction ID: b15ff473d9c0669085c27aee5ccbc430af63c8439af30eb7c8526f10810d395c
Opcode Fuzzy Hash: 6ef21f686a7c36c70eb70e59589049d029fcb9f1b7522ef2f7c9dea64f9488e1
Instruction Fuzzy Hash: 1A119D754093C06FDB228B15DC44A62BFA4DF57220F0980CAED848F263D2656808D762

Function 00A4BB04 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A4BB6A

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a1703ba0f559928df593b9fd9a15c6bed5f3d636602cc24677028b61aea8ced4
Instruction ID: 609527a5c2996de37efee791bf593d70502f0510fe8937d4ac7141d33eda361d
Opcode Fuzzy Hash: a1703ba0f559928df593b9fd9a15c6bed5f3d636602cc24677028b61aea8ced4
Instruction Fuzzy Hash: 4E116375404780AFDB228F55DC44B52FFF4EF49320F09889EE9898B562C375A419DB61

Function 00F81B7E Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E24), ref: 00F81BE7

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b41a9f8afa81381577264402c5430a4ef68be7d2f75f425df5b5c9b19dc4bd6d
Instruction ID: c572b34b8abce7c15947ef800ee40175a6cf3c0e0177d69c67c6f1f1d1bc1e12
Opcode Fuzzy Hash: b41a9f8afa81381577264402c5430a4ef68be7d2f75f425df5b5c9b19dc4bd6d
Instruction Fuzzy Hash: 3E11CE75544200AEFB209B11DC85BA6FBACEF44724F14849AEE084B281D3B4A949CAA6

Function 00F82BE2 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 00F82C38

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 13150d69f0eea2a236b4d695af73e63c6ebb053d3e3254587418752080579192
Instruction ID: 8dbc48c646dfd4bcf6ac405462cabe85fb735f3605e871f54482fe15995dc297
Opcode Fuzzy Hash: 13150d69f0eea2a236b4d695af73e63c6ebb053d3e3254587418752080579192
Instruction Fuzzy Hash: 5F114F759002049FEB60DF15D884FA6F7E8EF05720F0884AADD49CB251D771F848DB62

Function 00A4A078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00A4A0D5

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 83e055fb4112f73ec069f9fbceb5539b39c5f5f9d4aa5b04b52f542884d2bd30
Instruction ID: 46dddd9c22b108d7269fab861ef8ed683e0defb6aed43cd8a842ce289a5edebf
Opcode Fuzzy Hash: 83e055fb4112f73ec069f9fbceb5539b39c5f5f9d4aa5b04b52f542884d2bd30
Instruction Fuzzy Hash: D711BF75408380AFDB22CF15DC44B52FFB4EF5A224F08849AED898B652C275A818CB62

Function 00A4B126 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00A4B16E

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 7bc6046f01a6f28adb329ef114a682b7f7fe39f934ecdfb3b77d130684eebcfa
Instruction ID: 7c9c3f54e2184032152f5a33491edd0c06c32f21a74bdc67d274db693cb7657b
Opcode Fuzzy Hash: 7bc6046f01a6f28adb329ef114a682b7f7fe39f934ecdfb3b77d130684eebcfa
Instruction Fuzzy Hash: AD115E75A142409FEB20CF29D895B56FBE8EF54720F0885AADD49CB351D774E804CB72

Function 00F804E6 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E24,5E6642BF,00000000,00000000,00000000,00000000), ref: 00F80539

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6c06f678c6e80c20ed3acbd82b38e540113af2451d4d37328c6102bdc8c615cb
Instruction ID: 0b7f00c00a4224a32134ec4de1919824104e0263915bdd947988b27a0c3cc0f4
Opcode Fuzzy Hash: 6c06f678c6e80c20ed3acbd82b38e540113af2451d4d37328c6102bdc8c615cb
Instruction Fuzzy Hash: 2801C075904200AFFB20DF01DC85BA6F7E8DF04724F18849AEE098F281D774A9088AB6

Function 00A4A918 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 00A4A96F

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: c6fb4a369c4d6d5ce52f4f283c9e211d1b2014549358fe3050f593c9394181e0
Instruction ID: b5b9a3b05305f1cffeddacb2cd4882f781ac27fb76c189bd03f1aaade17d7a3e
Opcode Fuzzy Hash: c6fb4a369c4d6d5ce52f4f283c9e211d1b2014549358fe3050f593c9394181e0
Instruction Fuzzy Hash: D6115E754083809FDB218F55DC85B56FFE8EF56320F0984DAED898F263D275A808CB62

Function 00F8172A Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 00F81776

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 74ccc89f6c120c4c6891a5faa22375c9211dfafd6a34b93a1e51b72200aa11df
Instruction ID: 9d181bfa7e8eb3596255ef2dabddc318b3efc8b927dcb2232b3789e0f65f4066
Opcode Fuzzy Hash: 74ccc89f6c120c4c6891a5faa22375c9211dfafd6a34b93a1e51b72200aa11df
Instruction Fuzzy Hash: F21170358002009FEB20DF55D844B96FBE8FF08320F08C99ADD498B651D335E419EB61

Function 00F818F2 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNEL32(?,00000E24,?,?), ref: 00F81942

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 3c8109d8d93759680a147cf8a2392ea528a902ae3546445d26404e7528229c15
Instruction ID: 23a26c57bd08ddaad417f8916186cec463f4c7db953f58ac8e8995bdb851c068
Opcode Fuzzy Hash: 3c8109d8d93759680a147cf8a2392ea528a902ae3546445d26404e7528229c15
Instruction Fuzzy Hash: 9401BC72900200AFD310DF16DC86B26FBE8FB88A20F14856AED099B741D731B915CBE1

Function 00A4BB26 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A4BB6A

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ced2ef8fe3bbe4319c4001de35f55866961b35cbdbe09b05785df2bdf6fa4003
Instruction ID: 07cd50fcb70047504441f2fb347f39b61626470e11d8f06aaedc47d9816ead7e
Opcode Fuzzy Hash: ced2ef8fe3bbe4319c4001de35f55866961b35cbdbe09b05785df2bdf6fa4003
Instruction Fuzzy Hash: 1101AD358007009FDB218F55D844B52FBF0EF48320F08C89ADE4A4B655C371E415DF62

Function 00F80972 Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(?,00000E24,?,?), ref: 00F809C2

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d19e8022f50386bf41c89b8925906d699e8f004a89d09dbe1e9250cb29cd19ed
Instruction ID: 60e8836530d118f60ce896ce0aeab2a37a84bc0ce4a46c93873b72a1a26abd51
Opcode Fuzzy Hash: d19e8022f50386bf41c89b8925906d699e8f004a89d09dbe1e9250cb29cd19ed
Instruction Fuzzy Hash: C901AD71640200AFD210DF16DC86B26FBE8FB88A20F14815AED089B781D771F915CBE6

Function 00A4A09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00A4A0D5

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: aee9ea5f46eea24efc170710d0a8605234ad6f2a6d81b2d007528b072e893035
Instruction ID: 1288e66a49fc556a89b4d290c621c2122e5f0aed9912c64538c0d374f0e3e8a8
Opcode Fuzzy Hash: aee9ea5f46eea24efc170710d0a8605234ad6f2a6d81b2d007528b072e893035
Instruction Fuzzy Hash: C401B1758442409FEB20CF55D884B56FBE4EF54324F08C49ADE498F652D375A404DBA2

Function 00A4A93A Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 00A4A96F

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: f26555d6991152f72695f426072ca7b886ab4350e0d3533ccf1052d0cf61a151
Instruction ID: ceb03cf64965696726c5cc82d660a7648e2989964a58ab36b23431711d3481e9
Opcode Fuzzy Hash: f26555d6991152f72695f426072ca7b886ab4350e0d3533ccf1052d0cf61a151
Instruction Fuzzy Hash: 9701AD798042409FEB20CF15D884B66FBE4EF54320F09C8AADE498F396D375A404CBA3

Function 00F81AE6 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CoGetObjectContext.COMBASE(?,?), ref: 00F81B1B

Memory Dump Source

Source File: 00000000.00000002.3635124120.0000000000F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 031fb3d7911953b0268ffa42e1b1dfb2dcca67c84fc32ce97be3bb6239d9e978
Instruction ID: 3f627f47a708d9bebf1eb07ba1c580db509f1edf53b4e8eceed40e9cd95baff7
Opcode Fuzzy Hash: 031fb3d7911953b0268ffa42e1b1dfb2dcca67c84fc32ce97be3bb6239d9e978
Instruction Fuzzy Hash: 3DF08C359042449FEB209F05D884BA5FBE8FF44724F08C1AADE494F356E375A819DBA2

Function 00A4A2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,5E6642BF,00000000,?,?,?,?,?,?,?,?,6D073C58), ref: 00A4A330

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 2b21301869aba3bc323d8a5ed2a625e1a4f9bb7ef29c1443a900d64520c289df
Instruction ID: 170ae86e1ce5cf356ae7ad86c7c89c6df504cc52ad2e74f1e589e3f7039f6a2c
Opcode Fuzzy Hash: 2b21301869aba3bc323d8a5ed2a625e1a4f9bb7ef29c1443a900d64520c289df
Instruction Fuzzy Hash: CCF0AF39804640DFEB208F09D888765FBE4EF54724F48C09ADD494F392E375A804CAA3

Function 00A4A710 Relevance: 1.3, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,5E6642BF,00000000,?,?,?,?,?,?,?,?,6D073C58), ref: 00A4A780

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0f07a036ca4617d609f7f50aaea600420603828f4096e6f044b60ae2bc9ebbd1
Instruction ID: 9931ed218252213f0f0f27deb0bbf158c714e591ebdfc67cd617de79c593520d
Opcode Fuzzy Hash: 0f07a036ca4617d609f7f50aaea600420603828f4096e6f044b60ae2bc9ebbd1
Instruction Fuzzy Hash: 732127BA4083809FDB128F15DC85752BFB4EF12324F0980EBDC458F293D2359909CBA2

Function 00A4B47C Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,5E6642BF,00000000,?,?,?,?,?,?,?,?,6D073C58), ref: 00A4B4E8

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6b3f6c16e231e1d2451af89b1ce022590f9fd5f59f971808bcafb7dc0a91cf8b
Instruction ID: f93fbd68854fa142a384e413e9ea21329f99c9d2a591b90ad9aa8c3886dd82dc
Opcode Fuzzy Hash: 6b3f6c16e231e1d2451af89b1ce022590f9fd5f59f971808bcafb7dc0a91cf8b
Instruction Fuzzy Hash: 1421AE765093C05FEB128B25DC54B92BFB4AF47324F0984DAE8858F663D264A908CB62

Function 00A4A9B5 Relevance: 1.3, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,5E6642BF,00000000,?,?,?,?,?,?,?,?,6D073C58), ref: 00A4AA14

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: bb18a37446e94b258fb60d0ad65b657a5cf3bfe35e11840de250531cd2d89530
Instruction ID: ea2f27a9e4d4a1df021384cf355da3151e3b907d69c3aabfa978fdd8cf131673
Opcode Fuzzy Hash: bb18a37446e94b258fb60d0ad65b657a5cf3bfe35e11840de250531cd2d89530
Instruction Fuzzy Hash: 0B1160754093C05FDB128F25DC44B52BFB4EF46210F0984DAED858F253C275A918DB62

Function 00A4B4B6 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,5E6642BF,00000000,?,?,?,?,?,?,?,?,6D073C58), ref: 00A4B4E8

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 592f3e7e5d5977015d8c6b6bba51a404f4927cfaabf457c9a9cebdc903e3a194
Instruction ID: 58c47bdf76156034ebf3e412e49051520dc2131a145962de466769917cf118a5
Opcode Fuzzy Hash: 592f3e7e5d5977015d8c6b6bba51a404f4927cfaabf457c9a9cebdc903e3a194
Instruction Fuzzy Hash: B4017C799142409FEB208F1AD885766FBE4EF44720F18C4AADD4A8F656D375E804CAB2

Function 00A4A74E Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,5E6642BF,00000000,?,?,?,?,?,?,?,?,6D073C58), ref: 00A4A780

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7c0a47522aee90ab547e0575faf3c805a388b7e6d2dca8a2041ac0de2fb324cc
Instruction ID: daa963408357c483b95a1eeaf91a6935a25d34de6bb7c8c0c6c19fecf211dc3a
Opcode Fuzzy Hash: 7c0a47522aee90ab547e0575faf3c805a388b7e6d2dca8a2041ac0de2fb324cc
Instruction Fuzzy Hash: AB018F799042409FEB208F15D985766FBE4EF54724F08C4ABDD49CF356D275A804CAA2

Function 00A4A9E2 Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,5E6642BF,00000000,?,?,?,?,?,?,?,?,6D073C58), ref: 00A4AA14

Memory Dump Source

Source File: 00000000.00000002.3634071680.0000000000A4A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A4A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a4a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ee2aeaedee80c5a1123b453da499edf81557787e3585efc5a7b6e0cd082456e8
Instruction ID: 10e9921848337ef257b2c7a718153b08f157f2065c4f477e687d38e8874dc9a4
Opcode Fuzzy Hash: ee2aeaedee80c5a1123b453da499edf81557787e3585efc5a7b6e0cd082456e8
Instruction Fuzzy Hash: 5401D1798042809FEB20CF15D984766FBE4EF54324F18C4AADD098F346D379A404CBA2

Function 00A508FC Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3634111578.0000000000A50000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af78e9959ba83cc078edb935014f91d1cdd4f34a5bea2e6108967f696b39c4be
Instruction ID: 34bf2d66ed4b4dfc92eaaeae02dc9952cc86b01954681fba03958381ef7bf393
Opcode Fuzzy Hash: af78e9959ba83cc078edb935014f91d1cdd4f34a5bea2e6108967f696b39c4be
Instruction Fuzzy Hash: 2121493514E7C09FD717CB20C990B15BFB1AB47314F1989DED8858B6A3C33A884ACB52

Function 00A50934 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3634111578.0000000000A50000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d95d05fa79d21065c292e85c6530dbfc800cb20218585934f06b038ddf3cd58
Instruction ID: 3238ffac4e819bb3878ecf27e86de9860f6f2a8abc99a23cabe72bbe471d621c
Opcode Fuzzy Hash: 8d95d05fa79d21065c292e85c6530dbfc800cb20218585934f06b038ddf3cd58
Instruction Fuzzy Hash: 7211AF30208240DFE715CB10C940F26F7A5BB89719F24C99CE9890B697C77B9807CA91

Function 05222409 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636349037.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5220000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdda77b96061a8b38a13aebb083057addd4c0534b3e4c90a113e38ebaddb6a45
Instruction ID: a5739b05c648777e04bbdf04ba3a748388a872967aa4912a15dc1ca10b1f7512
Opcode Fuzzy Hash: bdda77b96061a8b38a13aebb083057addd4c0534b3e4c90a113e38ebaddb6a45
Instruction Fuzzy Hash: 1511D7B5908301AFD350CF19D880A5BFBE4FB88664F04892EF998D7311D331E9148FA2

Function 00A6B5A0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3634237584.0000000000A6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a6a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b6122b0e95192e7e1d9f776587b3e6f3785ecd39dbe954d39331b02305637d
Instruction ID: c808f45b700e454293e96644db256e12339d0860d73f7fadf4ad1c70e2003f35
Opcode Fuzzy Hash: 37b6122b0e95192e7e1d9f776587b3e6f3785ecd39dbe954d39331b02305637d
Instruction Fuzzy Hash: 2511BAB5908301AFD350CF09DC45E5BFBE8EB98660F14891EF99997311D271E9188FA2

Function 052222A4 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636349037.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5220000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3de7f15171aa624faf6a82b94b93ead157986e0a6abf631925c47aa3425ef81
Instruction ID: 40d0c6a90638849c45053c140a5958199096088f052b5b7e6350bf21701d9400
Opcode Fuzzy Hash: c3de7f15171aa624faf6a82b94b93ead157986e0a6abf631925c47aa3425ef81
Instruction Fuzzy Hash: 8811BAB5908301AFD750CF09DC81E5BFBE9EB88660F14891EF95997311D271E9188FA2

Function 00A505E0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3634111578.0000000000A50000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa924dfac492bce35ee7749994920545e01ef64bb0af0b8d95d671d0c3c6843
Instruction ID: cec75a01f7ee1345514eb9b4d3bf87b2dfcfed29e7c4d1973b965eb9a3bfacac
Opcode Fuzzy Hash: eaa924dfac492bce35ee7749994920545e01ef64bb0af0b8d95d671d0c3c6843
Instruction Fuzzy Hash: DE01D67640D7806FD7128F169C40862FFB8EE86520709C4AFEC498B653C225A909CB76

Function 00A509F0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3634111578.0000000000A50000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05cdb7f214e239aa91d766f391dffd0ca2371259be4fa2c6d7f0f99ca3569340
Instruction ID: 6a3f05c0315ce8dfbc1a8ab6b435882cef17fed9b8992f8d0c29dae561765466
Opcode Fuzzy Hash: 05cdb7f214e239aa91d766f391dffd0ca2371259be4fa2c6d7f0f99ca3569340
Instruction Fuzzy Hash: F7F0F635248644DFC316CF00D980F25FBA2FB89718F24CAA9E9490B666C737A816DA81

Function 00A50606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3634111578.0000000000A50000.00000040.00000020.00020000.00000000.sdmp, Offset: 00A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a50000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87b930b8044b1b5db077c8fee8e53181373dda3231f2383f18557663e3845ed2
Instruction ID: 89158f7a76331ce0556be3985203a3f057f6540424ed3bd06ffec88239b878fb
Opcode Fuzzy Hash: 87b930b8044b1b5db077c8fee8e53181373dda3231f2383f18557663e3845ed2
Instruction Fuzzy Hash: DDE092B66046004B9650CF0BEC41452F7D8EB84A30718C07FDC0D8B701D275B504CAA5

Function 00A6B5EF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3634237584.0000000000A6A000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A6A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a6a000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80366f2210604cec68e70231550fea42896e6b37d1366bdd0499b3867448067c
Instruction ID: 4ffefa8dd3ffe8161ee285389ed8747765c6b0d3c1b1e849041989cba446c747
Opcode Fuzzy Hash: 80366f2210604cec68e70231550fea42896e6b37d1366bdd0499b3867448067c
Instruction Fuzzy Hash: 9AE0DFB294020467D2208E06AC46F23FB9CEB54A30F08C56BEE095B742E172B9148AF6

Function 05221D17 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636349037.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5220000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa7ef12fc5716b8d878582df2944cc5a4b1ab76b2bc8c7b01b8fd79ea5f29821
Instruction ID: f123c9abec44f659e59972f63805ecdb82915cb6bfd1b98861847812f5f31ecd
Opcode Fuzzy Hash: aa7ef12fc5716b8d878582df2944cc5a4b1ab76b2bc8c7b01b8fd79ea5f29821
Instruction Fuzzy Hash: 41E0D8B694020067D2109E069C45F13FBDCEB44930F08C457EE095B341D1727514CDF5

Function 0522246B Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636349037.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5220000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f07245fc0a2a63f001588b1666d627de4f5e984a98e5a8c3c75496a37cbfb9d7
Instruction ID: e57d9febcb94ec922eb22669ed2cb8b6fb260820aada9d0083b81c1ba141b9c5
Opcode Fuzzy Hash: f07245fc0a2a63f001588b1666d627de4f5e984a98e5a8c3c75496a37cbfb9d7
Instruction Fuzzy Hash: B5E0D8B694020067D2508E069C45F13FBDCEB54930F08C467ED085B341D171751489F5

Function 052222F3 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3636349037.0000000005220000.00000040.00000800.00020000.00000000.sdmp, Offset: 05220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5220000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b575fa3e522b786ecc8d01ecf43bdfbea806f51bf01a5dcbea9261c5f2d791
Instruction ID: 36d7870732dabfffff8c9a5ffc7cbbe3d7d81dc31fa8321fc7f2d7f319d1a558
Opcode Fuzzy Hash: 12b575fa3e522b786ecc8d01ecf43bdfbea806f51bf01a5dcbea9261c5f2d791
Instruction Fuzzy Hash: 83E0D8B690020467D2509E069C45F13FBDCEB44930F08C457EE0D5B342D172751489F5

Function 00A423F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3634030673.0000000000A42000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A42000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a42000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 222a52ea1d04fa800afaf7a2737729842eedf212a24d2880a894ae63b1d51abf
Instruction ID: 682dd5358cae724369113814fadeeafe0905e4c2c199c96a1c7fcdd80d2fb29c
Opcode Fuzzy Hash: 222a52ea1d04fa800afaf7a2737729842eedf212a24d2880a894ae63b1d51abf
Instruction Fuzzy Hash: F8D05E792496814FE3169B1CC1A8BA937D4EB91714F8A44F9A8408B7A7C768D981D600

Function 00A423BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3634030673.0000000000A42000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A42000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a42000_#U0440#U043e#U0431#U043b#U043e#U043a#U0441.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0ec67c35fa75741fe06b3e0b63155b4ab3dea9985ff03f5f1bf8f4eb1e980a
Instruction ID: 989b2c54135f55da9ebb3687da3290dee99f91d52d552a7a54029c8761d40d47
Opcode Fuzzy Hash: 4e0ec67c35fa75741fe06b3e0b63155b4ab3dea9985ff03f5f1bf8f4eb1e980a
Instruction Fuzzy Hash: 6DD05E382042814BD715DF0CC2D4F5933E4AB80714F0A44E8BC108F266C7B8ECC0CA00

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report #U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Operating System Destruction

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
#U0440#U043e#U0431#U043b#U043e#U043a#U0441.exe