Edit tour

Windows Analysis Report
jpGSWjSTSw.exe

Overview

General Information

Sample name:	jpGSWjSTSw.exe renamed because original name is a hash value
Original sample name:	b1048f879fa97d356045037bddc4add3.exe
Analysis ID:	1431385
MD5:	b1048f879fa97d356045037bddc4add3
SHA1:	5e4a581b9756c930af7f0f07020fa668e1ec7143
SHA256:	3708d1bd614bd0a96c34dc96c7ef75bb6386b401b6e81b019293a8964447c90a
Tags:	exenjratRAT
Infos:

Detection

Njrat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Njrat

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Modifies the windows firewall

Uses netsh to modify the Windows network and firewall settings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

jpGSWjSTSw.exe (PID: 5456 cmdline: "C:\Users\user\Desktop\jpGSWjSTSw.exe" MD5: B1048F879FA97D356045037BDDC4ADD3)

netsh.exe (PID: 2460 cmdline: netsh firewall add allowedprogram "C:\Users\user\Desktop\jpGSWjSTSw.exe" "jpGSWjSTSw.exe" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 4764 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
NjRAT	RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim's camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim's desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.	AQUATIC PANDA Earth Lusca Operation C-Major The Gorgon Group	http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/ http://blogs.360.cn/post/analysis-of-apt-c-37.html http://threatgeek.typepad.com/files/fta-1009---njrat-uncovered-1.pdf https://about.fb.com/news/2021/04/taking-action-against-hackers-in-palestine/ https://asec.ahnlab.com/1369	https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat

Malware Configuration

Threatname: Njrat

{"Host": "0.tcp.eu.ngrok.io", "Port": "12143", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "server.exe", "Install Dir": "TEMP"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
jpGSWjSTSw.exe	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
jpGSWjSTSw.exe	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efa:$a3: Download ERROR 0x81ec:$a5: netsh firewall delete allowedprogram "
jpGSWjSTSw.exe	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e2:$a1: netsh firewall add allowedprogram 0x82dc:$b1: [TAP] 0x8282:$b2: & exit 0x824e:$c1: md.exe /k ping 0 & del
jpGSWjSTSw.exe	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81ec:$s1: netsh firewall delete allowedprogram 0x80e2:$s2: netsh firewall add allowedprogram 0x824c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ed6:$s4: Execute ERROR 0x7f36:$s4: Execute ERROR 0x7efa:$s5: Download ERROR 0x8292:$s6: [kl]

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x62c1:$a1: get_Registry 0x7cfa:$a3: Download ERROR 0x7fec:$a5: netsh firewall delete allowedprogram "
00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x7ee2:$a1: netsh firewall add allowedprogram 0x80dc:$b1: [TAP] 0x8082:$b2: & exit 0x804e:$c1: md.exe /k ping 0 & del
00000000.00000002.4421743474.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
Process Memory Space: jpGSWjSTSw.exe PID: 5456	JoeSecurity_Njrat	Yara detected Njrat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.jpGSWjSTSw.exe.7e0000.0.unpack	JoeSecurity_Njrat	Yara detected Njrat	Joe Security
0.0.jpGSWjSTSw.exe.7e0000.0.unpack	Windows_Trojan_Njrat_30f3c220	unknown	unknown	0x64c1:$a1: get_Registry 0x7efa:$a3: Download ERROR 0x81ec:$a5: netsh firewall delete allowedprogram "
0.0.jpGSWjSTSw.exe.7e0000.0.unpack	njrat1	Identify njRat	Brian Wallace @botnet_hunter	0x80e2:$a1: netsh firewall add allowedprogram 0x82dc:$b1: [TAP] 0x8282:$b2: & exit 0x824e:$c1: md.exe /k ping 0 & del
0.0.jpGSWjSTSw.exe.7e0000.0.unpack	MALWARE_Win_NjRAT	Detects NjRAT / Bladabindi	ditekSHen	0x81ec:$s1: netsh firewall delete allowedprogram 0x80e2:$s2: netsh firewall add allowedprogram 0x824c:$s3: 63 00 6D 00 64 00 2E 00 65 00 78 00 65 00 20 00 2F 00 6B 00 20 00 70 00 69 00 6E 00 67 0x7ed6:$s4: Execute ERROR 0x7f36:$s4: Execute ERROR 0x7efa:$s5: Download ERROR 0x8292:$s6: [kl]

Snort Signatures

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:14.492455
SID:	2814856
Source Port:	49795
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:13.487235
SID:	2814856
Source Port:	49794
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:12.820590
SID:	2814856
Source Port:	49793
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:09.631966
SID:	2814856
Source Port:	49790
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:11.801460
SID:	2814856
Source Port:	49792
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:10.518340
SID:	2814856
Source Port:	49791
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:04.144544
SID:	2814856
Source Port:	49785
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:05.117481
SID:	2814856
Source Port:	49786
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:07.225396
SID:	2814856
Source Port:	49788
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:05.846152
SID:	2814856
Source Port:	49787
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:08.962859
SID:	2814856
Source Port:	49789
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:06.488485
SID:	2814860
Source Port:	49787
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:09.194933
SID:	2814860
Source Port:	49789
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:07.439855
SID:	2814860
Source Port:	49788
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:04.678135
SID:	2814860
Source Port:	49785
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:05.414058
SID:	2814860
Source Port:	49786
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:59.865750
SID:	2814860
Source Port:	49780
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:03.709538
SID:	2814860
Source Port:	49784
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:49.235388
SID:	2814856
Source Port:	49894
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:54.832997
SID:	2814856
Source Port:	49898
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:01.443867
SID:	2814860
Source Port:	49782
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:47.290539
SID:	2814856
Source Port:	49892
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:19.216442
SID:	2033132
Source Port:	49800
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:20.694990
SID:	2033132
Source Port:	49802
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:45.363214
SID:	2814856
Source Port:	49890
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:55.262949
SID:	2814860
Source Port:	49898
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:03.161317
SID:	2814856
Source Port:	49784
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:51.818325
SID:	2814856
Source Port:	49773
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:26.217596
SID:	2033132
Source Port:	49808
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:01.034041
SID:	2814856
Source Port:	49782
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:48.129955
SID:	2814856
Source Port:	49771
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:58.977189
SID:	2814856
Source Port:	49780
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:22.367152
SID:	2033132
Source Port:	49804
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:24.126808
SID:	2033132
Source Port:	49806
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:10.084381
SID:	2814860
Source Port:	49790
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:12.381302
SID:	2814860
Source Port:	49792
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:52.849891
SID:	2814860
Source Port:	49773
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:14.053075
SID:	2814860
Source Port:	49794
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:48.740558
SID:	2814860
Source Port:	49771
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:49.409574
SID:	2814860
Source Port:	49894
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:15.254451
SID:	2814856
Source Port:	49796
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:48.127008
SID:	2814860
Source Port:	49892
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:54.026421
SID:	2814856
Source Port:	49775
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:56.071957
SID:	2814856
Source Port:	49777
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:17.768087
SID:	2814856
Source Port:	49798
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:58.428158
SID:	2814860
Source Port:	49779
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:18.272444
SID:	2814860
Source Port:	49798
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:57.973481
SID:	2814856
Source Port:	49779
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:56.412799
SID:	2814860
Source Port:	49777
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:46.155660
SID:	2814860
Source Port:	49890
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:16.099908
SID:	2814860
Source Port:	49796
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:54.929224
SID:	2814860
Source Port:	49775
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:51.181362
SID:	2814856
Source Port:	49896
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:31.504362
SID:	2814856
Source Port:	49876
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:30.685115
SID:	2814856
Source Port:	49875
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:40.257198
SID:	2814860
Source Port:	49762
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:07.008677
SID:	2033132
Source Port:	49788
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:08.747793
SID:	2033132
Source Port:	49789
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:28.271247
SID:	2814856
Source Port:	49872
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:34.441584
SID:	2814856
Source Port:	49879
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:38.833719
SID:	2814860
Source Port:	49761
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:00.819507
SID:	2033132
Source Port:	49782
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:37.335616
SID:	2033132
Source Port:	49821
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:38.614370
SID:	2033132
Source Port:	49822
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:00.599923
SID:	2825564
Source Port:	49781
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:00.088013
SID:	2033132
Source Port:	49781
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:31.071312
SID:	2814860
Source Port:	49875
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:32.308248
SID:	2814860
Source Port:	49876
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:01.009601
SID:	2033132
Source Port:	49706
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:35.652450
SID:	2033132
Source Port:	49819
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:46.323695
SID:	2033132
Source Port:	49829
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:46:57.885770
SID:	2033132
Source Port:	49705
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:25.812583
SID:	2814856
Source Port:	49751
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:39.540590
SID:	2814856
Source Port:	49762
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:38.188784
SID:	2814856
Source Port:	49761
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:31.730194
SID:	2033132
Source Port:	49815
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:22.146852
SID:	2814860
Source Port:	49803
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:41.373666
SID:	2033132
Source Port:	49825
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:43.536037
SID:	2033132
Source Port:	49826
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:32.351209
SID:	2033132
Source Port:	49816
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:24.523020
SID:	2814860
Source Port:	49806
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:48.798631
SID:	2825564
Source Port:	49893
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:20.910124
SID:	2814856
Source Port:	49802
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:22.023774
SID:	2814856
Source Port:	49865
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:22.700008
SID:	2814856
Source Port:	49866
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:57.758029
SID:	2033132
Source Port:	49779
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:41.635506
SID:	2814856
Source Port:	49886
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:56.630895
SID:	2033132
Source Port:	49778
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:18.496969
SID:	2033132
Source Port:	49799
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:42.545910
SID:	2814856
Source Port:	49887
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:38.816417
SID:	2814856
Source Port:	49883
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:18.640802
SID:	2814856
Source Port:	49861
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:25.512110
SID:	2814856
Source Port:	49869
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:38.223177
SID:	2814856
Source Port:	49882
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:21.708124
SID:	2814856
Source Port:	49803
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:48.740558
SID:	2825564
Source Port:	49771
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:28.381325
SID:	2033132
Source Port:	49811
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:50.963248
SID:	2033132
Source Port:	49896
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:49.508535
SID:	2033132
Source Port:	49832
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:50.800930
SID:	2033132
Source Port:	49833
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:47.914116
SID:	2033132
Source Port:	49771
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:49.627002
SID:	2825564
Source Port:	49772
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:11.586072
SID:	2033132
Source Port:	49792
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:49.627911
SID:	2033132
Source Port:	49895
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:46.989329
SID:	2033132
Source Port:	49770
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:10.303680
SID:	2033132
Source Port:	49791
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:24.343699
SID:	2814856
Source Port:	49806
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:23.287546
SID:	2814860
Source Port:	49866
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:43.226792
SID:	2814860
Source Port:	49887
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:21.271785
SID:	2814860
Source Port:	49802
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:42.114011
SID:	2814860
Source Port:	49886
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:49.188492
SID:	2825563
Source Port:	49772
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:24.980519
SID:	2814856
Source Port:	49807
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:29.114643
SID:	2033132
Source Port:	49812
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:22.263133
SID:	2814860
Source Port:	49865
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:19.757886
SID:	2814860
Source Port:	49862
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:38.384394
SID:	2814860
Source Port:	49882
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:03.928617
SID:	2825563
Source Port:	49707
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:42.265849
SID:	2814856
Source Port:	49765
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:24.523020
SID:	2825564
Source Port:	49806
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:01.227381
SID:	2825563
Source Port:	49706
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:43.332834
SID:	2814856
Source Port:	49766
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:14.642145
SID:	2814856
Source Port:	49744
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:46.771894
SID:	2814860
Source Port:	49769
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:18.843017
SID:	2814860
Source Port:	49861
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:17.200892
SID:	2814856
Source Port:	49745
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:39.097115
SID:	2814860
Source Port:	49883
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:21.801758
SID:	2814856
Source Port:	49748
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:52.961389
SID:	2033132
Source Port:	49774
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:14.273815
SID:	2033132
Source Port:	49795
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:46.267043
SID:	2814856
Source Port:	49769
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:44.008650
SID:	2814860
Source Port:	49766
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:47.074202
SID:	2033132
Source Port:	49892
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:19.279792
SID:	2814856
Source Port:	49862
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:53.810808
SID:	2033132
Source Port:	49775
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:15.038634
SID:	2033132
Source Port:	49796
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:46.373858
SID:	2033132
Source Port:	49891
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:42.897252
SID:	2814860
Source Port:	49765
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:23.329438
SID:	2814856
Source Port:	49749
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:12.036590
SID:	2814856
Source Port:	49855
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:50.363474
SID:	2814856
Source Port:	49731
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:29.987743
SID:	2814856
Source Port:	49813
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:45.332773
SID:	2033132
Source Port:	49768
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:54.124278
SID:	2814856
Source Port:	49897
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:42.897252
SID:	2825564
Source Port:	49765
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:02.725444
SID:	2814860
Source Port:	49783
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:48.568645
SID:	2814856
Source Port:	49893
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:01.034235
SID:	2033132
Source Port:	49843
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:40.557828
SID:	2033132
Source Port:	49885
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:36.837180
SID:	2033132
Source Port:	49760
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:21.193171
SID:	2825563
Source Port:	49720
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:22.233811
SID:	2814860
Source Port:	49748
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:30.834319
SID:	2814860
Source Port:	49813
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:15.244343
SID:	2814856
Source Port:	49859
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:33.830327
SID:	2814856
Source Port:	49817
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:12.317794
SID:	2814860
Source Port:	49855
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:44.209383
SID:	2033132
Source Port:	49889
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:54.399333
SID:	2814860
Source Port:	49897
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:20.085427
SID:	2033132
Source Port:	49801
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:01.885480
SID:	2814856
Source Port:	49783
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:41.601384
SID:	2033132
Source Port:	49727
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:49.188492
SID:	2814856
Source Port:	49772
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:04.507433
SID:	2033132
Source Port:	49847
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:53.850267
SID:	2033132
Source Port:	49836
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:29.802259
SID:	2033132
Source Port:	49723
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:26.012163
SID:	2814860
Source Port:	49869
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:23.328512
SID:	2033132
Source Port:	49805
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:34.162345
SID:	2814860
Source Port:	49817
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:16.066012
SID:	2814860
Source Port:	49859
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:45.287359
SID:	2814860
Source Port:	49827
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:42.114011
SID:	2825564
Source Port:	49886
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:27.162480
SID:	2033132
Source Port:	49809
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:49.627002
SID:	2814860
Source Port:	49772
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:13.053063
SID:	2814860
Source Port:	49793
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:47.546665
SID:	2825563
Source Port:	49730
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:36.220154
SID:	2814860
Source Port:	49759
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:07.054780
SID:	2814860
Source Port:	49738
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:08.764388
SID:	2814860
Source Port:	49851
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:48.798631
SID:	2814860
Source Port:	49893
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:48.318567
SID:	2814860
Source Port:	49830
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:55.366936
SID:	2814856
Source Port:	49776
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:30.725768
SID:	2814856
Source Port:	49755
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:47:58.707738
SID:	2814856
Source Port:	49734
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:28.482374
SID:	2814860
Source Port:	49872
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:36.005501
SID:	2814856
Source Port:	49759
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:30.942694
SID:	2814860
Source Port:	49755
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:03.929746
SID:	2033132
Source Port:	49785
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:47:58.921720
SID:	2814860
Source Port:	49734
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:47.787361
SID:	2814856
Source Port:	49830
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:08.262223
SID:	2814856
Source Port:	49851
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:36.747530
SID:	2033132
Source Port:	49881
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:41.273956
SID:	2033132
Source Port:	49764
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:55.624037
SID:	2814860
Source Port:	49776
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:17.334361
SID:	2814860
Source Port:	49797
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:06.625779
SID:	2814856
Source Port:	49738
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:13.049981
SID:	2033132
Source Port:	49743
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:09.364361
SID:	2814856
Source Port:	49710
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:21.585946
SID:	2033132
Source Port:	49748
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:49.726668
SID:	2814856
Source Port:	49832
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:51.975735
SID:	2814856
Source Port:	49834
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:18.244215
SID:	2033132
Source Port:	49746
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:16.985233
SID:	2033132
Source Port:	49745
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:23.116308
SID:	2033132
Source Port:	49749
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:51.013123
SID:	2814856
Source Port:	49833
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:55.364597
SID:	2814856
Source Port:	49837
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:16.281870
SID:	2033132
Source Port:	49860
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:18.425768
SID:	2033132
Source Port:	49861
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:54.064458
SID:	2814856
Source Port:	49836
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:19.064775
SID:	2033132
Source Port:	49862
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:12.532093
SID:	2814856
Source Port:	49717
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:19.750801
SID:	2033132
Source Port:	49747
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:53.268900
SID:	2814856
Source Port:	49835
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:21.234586
SID:	2033132
Source Port:	49864
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:19.976915
SID:	2033132
Source Port:	49863
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:21.810842
SID:	2033132
Source Port:	49865
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:53.631192
SID:	2814860
Source Port:	49835
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:52.834433
SID:	2814860
Source Port:	49834
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:23.507279
SID:	2033132
Source Port:	49867
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:25.083870
SID:	2825564
Source Port:	49868
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:56.157929
SID:	2814856
Source Port:	49838
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:50.584197
SID:	2814860
Source Port:	49832
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:22.483591
SID:	2033132
Source Port:	49866
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:51.537309
SID:	2814860
Source Port:	49833
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:57.003292
SID:	2814856
Source Port:	49839
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:24.222070
SID:	2033132
Source Port:	49868
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:25.299879
SID:	2033132
Source Port:	49869
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:14.378165
SID:	2033132
Source Port:	49858
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:52.852185
SID:	2033132
Source Port:	49732
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:54.927960
SID:	2814860
Source Port:	49836
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:05.240470
SID:	2814860
Source Port:	49847
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:55.040157
SID:	2033132
Source Port:	49733
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:55.724852
SID:	2814860
Source Port:	49837
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:06.180507
SID:	2814860
Source Port:	49848
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:15.028075
SID:	2033132
Source Port:	49859
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:15.194657
SID:	2814856
Source Port:	49718
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:56.568726
SID:	2814860
Source Port:	49838
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:07.118610
SID:	2814860
Source Port:	49849
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:10.702303
SID:	2825564
Source Port:	49853
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:03.928617
SID:	2814856
Source Port:	49707
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:17.931482
SID:	2814856
Source Port:	49719
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:57.849869
SID:	2814860
Source Port:	49839
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:06.751061
SID:	2814856
Source Port:	49708
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:17.205300
SID:	2825564
Source Port:	49860
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:24.121861
SID:	2814856
Source Port:	49721
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:39.472335
SID:	2814856
Source Port:	49823
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:04.413544
SID:	2033132
Source Port:	49737
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:06.411435
SID:	2033132
Source Port:	49738
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:33.702642
SID:	2033132
Source Port:	49757
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:35.790974
SID:	2033132
Source Port:	49759
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:01.248018
SID:	2814856
Source Port:	49843
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:03.145932
SID:	2814856
Source Port:	49845
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:47:58.707738
SID:	2825563
Source Port:	49734
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:00.711821
SID:	2033132
Source Port:	49735
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:08.338010
SID:	2033132
Source Port:	49739
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:27.083860
SID:	2814856
Source Port:	49722
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:38.828297
SID:	2814856
Source Port:	49822
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:43.749275
SID:	2814856
Source Port:	49826
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:47:58.921720
SID:	2825564
Source Port:	49734
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:31.533275
SID:	2033132
Source Port:	49756
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:01.878885
SID:	2814856
Source Port:	49844
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:05.677206
SID:	2814856
Source Port:	49848
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:27.144262
SID:	2033132
Source Port:	49871
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:46:58.101854
SID:	2814856
Source Port:	49705
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:04.722520
SID:	2814856
Source Port:	49847
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:07.336000
SID:	2033132
Source Port:	49850
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:41.816992
SID:	2814856
Source Port:	49727
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:41.589318
SID:	2814856
Source Port:	49825
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:02.571086
SID:	2033132
Source Port:	49736
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:28.058043
SID:	2033132
Source Port:	49872
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:28.702815
SID:	2033132
Source Port:	49873
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:21.193171
SID:	2814856
Source Port:	49720
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:44.738721
SID:	2814856
Source Port:	49728
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:40.427505
SID:	2814856
Source Port:	49824
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:01.227381
SID:	2814856
Source Port:	49706
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:34.582567
SID:	2033132
Source Port:	49758
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:03.774478
SID:	2814856
Source Port:	49846
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:08.049827
SID:	2033132
Source Port:	49851
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:47.333096
SID:	2033132
Source Port:	49730
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:29.611673
SID:	2033132
Source Port:	49874
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:30.470374
SID:	2033132
Source Port:	49875
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:08.982610
SID:	2033132
Source Port:	49852
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:10.923828
SID:	2033132
Source Port:	49854
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:39.062267
SID:	2814856
Source Port:	49726
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:50.149111
SID:	2033132
Source Port:	49731
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:04.287324
SID:	2814860
Source Port:	49846
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:41.148587
SID:	2814860
Source Port:	49824
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:10.040349
SID:	2033132
Source Port:	49853
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:13.509872
SID:	2033132
Source Port:	49857
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:35.782511
SID:	2814856
Source Port:	49725
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:44.425673
SID:	2814856
Source Port:	49827
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:03.334339
SID:	2814860
Source Port:	49845
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:33.301819
SID:	2033132
Source Port:	49878
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:39.990511
SID:	2814860
Source Port:	49823
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:06.615743
SID:	2814856
Source Port:	49849
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:12.534157
SID:	2033132
Source Port:	49856
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:30.015631
SID:	2814856
Source Port:	49723
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:46.538707
SID:	2814856
Source Port:	49829
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:01.443589
SID:	2814860
Source Port:	49843
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:31.290147
SID:	2033132
Source Port:	49876
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:32.527377
SID:	2033132
Source Port:	49877
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:32.871207
SID:	2814856
Source Port:	49724
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:45.724279
SID:	2814856
Source Port:	49828
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:02.709201
SID:	2814860
Source Port:	49844
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:39.037374
SID:	2814860
Source Port:	49822
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:11.822550
SID:	2033132
Source Port:	49855
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:39.062267
SID:	2825563
Source Port:	49726
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:59.287121
SID:	2814860
Source Port:	49841
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:35.782511
SID:	2825563
Source Port:	49725
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:41.816992
SID:	2825563
Source Port:	49727
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:38.381115
SID:	2814860
Source Port:	49821
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:32.871207
SID:	2825563
Source Port:	49724
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:44.738721
SID:	2825563
Source Port:	49728
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:37.115508
SID:	2814860
Source Port:	49820
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:24.553737
SID:	2033132
Source Port:	49750
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:58.474842
SID:	2814860
Source Port:	49840
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:25.599228
SID:	2033132
Source Port:	49751
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:26.665270
SID:	2033132
Source Port:	49752
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:58.289236
SID:	2814856
Source Port:	49840
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:47:58.493730
SID:	2033132
Source Port:	49734
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:26.230488
SID:	2033132
Source Port:	49870
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:27.991179
SID:	2033132
Source Port:	49753
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:30.509063
SID:	2033132
Source Port:	49755
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:59.021314
SID:	2814856
Source Port:	49841
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:37.549532
SID:	2814856
Source Port:	49821
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:36.663946
SID:	2814856
Source Port:	49820
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:29.176543
SID:	2033132
Source Port:	49754
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:59.761515
SID:	2814856
Source Port:	49842
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:53.067650
SID:	2814856
Source Port:	49732
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:29.328158
SID:	2814856
Source Port:	49812
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:11.139614
SID:	2814856
Source Port:	49854
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:12.747197
SID:	2814856
Source Port:	49856
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:44.234537
SID:	2033132
Source Port:	49767
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:38.007019
SID:	2033132
Source Port:	49882
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:07.549051
SID:	2814856
Source Port:	49850
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:14.590649
SID:	2814856
Source Port:	49858
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:47.546665
SID:	2814856
Source Port:	49730
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:31.266597
SID:	2814856
Source Port:	49814
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:39.314933
SID:	2033132
Source Port:	49884
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:58.072537
SID:	2033132
Source Port:	49840
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:46.053331
SID:	2033132
Source Port:	49769
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:41.420661
SID:	2033132
Source Port:	49886
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:23.753410
SID:	2814860
Source Port:	49749
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:59.546636
SID:	2033132
Source Port:	49842
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:03.558976
SID:	2033132
Source Port:	49846
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:20.976512
SID:	2033132
Source Port:	49720
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:32.567051
SID:	2814856
Source Port:	49816
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:13.291521
SID:	2814860
Source Port:	49856
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:24.121861
SID:	2825563
Source Port:	49721
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:29.541494
SID:	2814860
Source Port:	49812
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:34.596766
SID:	2814856
Source Port:	49818
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:11.603965
SID:	2814860
Source Port:	49854
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:43.447027
SID:	2033132
Source Port:	49888
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:01.663492
SID:	2033132
Source Port:	49844
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:10.098611
SID:	2814856
Source Port:	49740
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:56.789226
SID:	2033132
Source Port:	49839
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:12.320005
SID:	2033132
Source Port:	49717
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:32.659515
SID:	2033132
Source Port:	49724
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:44.523905
SID:	2033132
Source Port:	49728
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:55.149016
SID:	2033132
Source Port:	49837
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:34.227676
SID:	2033132
Source Port:	49879
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:31.506233
SID:	2814860
Source Port:	49814
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:14.803337
SID:	2814860
Source Port:	49858
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:05.461550
SID:	2033132
Source Port:	49848
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:17.718164
SID:	2033132
Source Port:	49719
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:26.868566
SID:	2033132
Source Port:	49722
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:43.962568
SID:	2814860
Source Port:	49826
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:33.396962
SID:	2814860
Source Port:	49816
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:35.428022
SID:	2814860
Source Port:	49818
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:59.287121
SID:	2825564
Source Port:	49841
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:46.099899
SID:	2814860
Source Port:	49828
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:38.848060
SID:	2033132
Source Port:	49726
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:05.056129
SID:	2814860
Source Port:	49737
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:50.363474
SID:	2825563
Source Port:	49731
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:55.537739
SID:	2825564
Source Port:	49733
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:55.255816
SID:	2825563
Source Port:	49733
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:14.159486
SID:	2825564
Source Port:	49857
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:09.364361
SID:	2825563
Source Port:	49710
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:26.879013
SID:	2814856
Source Port:	49752
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:09.822015
SID:	2814860
Source Port:	49852
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:28.162403
SID:	2814860
Source Port:	49810
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:27.840411
SID:	2814860
Source Port:	49871
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:29.393049
SID:	2814860
Source Port:	49873
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:29.389230
SID:	2814856
Source Port:	49754
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:49.287560
SID:	2814860
Source Port:	49831
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:00.925612
SID:	2814856
Source Port:	49735
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:31.747522
SID:	2814856
Source Port:	49756
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:35.220747
SID:	2814860
Source Port:	49758
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:07.831931
SID:	2814860
Source Port:	49850
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:37.975113
SID:	2033132
Source Port:	49761
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:08.554832
SID:	2814856
Source Port:	49739
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:09.884956
SID:	2033132
Source Port:	49740
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:04.628463
SID:	2814856
Source Port:	49737
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:11.366803
SID:	2033132
Source Port:	49742
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:34.795306
SID:	2814856
Source Port:	49758
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:02.947238
SID:	2033132
Source Port:	49784
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:40.481182
SID:	2033132
Source Port:	49763
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:14.428999
SID:	2033132
Source Port:	49744
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:27.307162
SID:	2814860
Source Port:	49752
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:04.900338
SID:	2033132
Source Port:	49786
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:09.197409
SID:	2814856
Source Port:	49852
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:28.920114
SID:	2814856
Source Port:	49873
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:15.194657
SID:	2825563
Source Port:	49718
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:29.814769
SID:	2814860
Source Port:	49754
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:27.987573
SID:	2814856
Source Port:	49810
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:35.843702
SID:	2033132
Source Port:	49880
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:48.756385
SID:	2814856
Source Port:	49831
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:42.051762
SID:	2033132
Source Port:	49765
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:37.480364
SID:	2814860
Source Port:	49760
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:32.742537
SID:	2814856
Source Port:	49877
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:07.439855
SID:	2825564
Source Port:	49788
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:27.359317
SID:	2814856
Source Port:	49871
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:26.444726
SID:	2814856
Source Port:	49870
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:33.516119
SID:	2814856
Source Port:	49878
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:58.764150
SID:	2033132
Source Port:	49780
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:36.448488
SID:	2033132
Source Port:	49820
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:40.210389
SID:	2033132
Source Port:	49824
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:41.148587
SID:	2825564
Source Port:	49824
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:42.055048
SID:	2825564
Source Port:	49825
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:33.083825
SID:	2814860
Source Port:	49877
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:39.258468
SID:	2033132
Source Port:	49823
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:03.715256
SID:	2033132
Source Port:	49707
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:24.766062
SID:	2814856
Source Port:	49750
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:33.616044
SID:	2033132
Source Port:	49817
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:45.509058
SID:	2033132
Source Port:	49828
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:34.383362
SID:	2033132
Source Port:	49818
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:37.051475
SID:	2814856
Source Port:	49760
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:06.537404
SID:	2033132
Source Port:	49708
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:23.100225
SID:	2814860
Source Port:	49804
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:23.764200
SID:	2814860
Source Port:	49805
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:44.211236
SID:	2033132
Source Port:	49827
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:37.115508
SID:	2825564
Source Port:	49820
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:26.944028
SID:	2814860
Source Port:	49808
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:27.553190
SID:	2814860
Source Port:	49809
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:43.661365
SID:	2814856
Source Port:	49888
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:19.431498
SID:	2814856
Source Port:	49800
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:22.582932
SID:	2814856
Source Port:	49804
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:20.300717
SID:	2814856
Source Port:	49801
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:23.542679
SID:	2814856
Source Port:	49805
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:18.990701
SID:	2825564
Source Port:	49799
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:46.848889
SID:	2825564
Source Port:	49891
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:48.351920
SID:	2033132
Source Port:	49893
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:36.963258
SID:	2814856
Source Port:	49881
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:49.018636
SID:	2033132
Source Port:	49894
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:47.572745
SID:	2033132
Source Port:	49830
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:16.495093
SID:	2814856
Source Port:	49860
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:24.436209
SID:	2814856
Source Port:	49868
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:44.421982
SID:	2814856
Source Port:	49889
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:12.605213
SID:	2033132
Source Port:	49793
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:09.148778
SID:	2033132
Source Port:	49710
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:53.907170
SID:	2033132
Source Port:	49897
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:52.251764
SID:	2825564
Source Port:	49773
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:26.433620
SID:	2814856
Source Port:	49808
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:29.771873
SID:	2033132
Source Port:	49813
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:25.083870
SID:	2814860
Source Port:	49868
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:44.923890
SID:	2814860
Source Port:	49889
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:48.539898
SID:	2033132
Source Port:	49831
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:53.054853
SID:	2033132
Source Port:	49835
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:27.376660
SID:	2814856
Source Port:	49809
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:27.772719
SID:	2033132
Source Port:	49810
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:31.052671
SID:	2033132
Source Port:	49814
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:24.003773
SID:	2814860
Source Port:	49867
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:09.415691
SID:	2033132
Source Port:	49790
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:43.993051
SID:	2814860
Source Port:	49888
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:54.618364
SID:	2033132
Source Port:	49898
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:19.865582
SID:	2814860
Source Port:	49800
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:20.474948
SID:	2814860
Source Port:	49801
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:51.757544
SID:	2033132
Source Port:	49834
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:46:58.101854
SID:	2825563
Source Port:	49705
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:40.694841
SID:	2814856
Source Port:	49763
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:11.580619
SID:	2814856
Source Port:	49742
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:40.339039
SID:	2814860
Source Port:	49884
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:17.205300
SID:	2814860
Source Port:	49860
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:21.591654
SID:	2814860
Source Port:	49864
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:41.200957
SID:	2814860
Source Port:	49885
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:41.490643
SID:	2814856
Source Port:	49764
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:21.015231
SID:	2814860
Source Port:	49863
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:13.267711
SID:	2814856
Source Port:	49743
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:37.780662
SID:	2814860
Source Port:	49881
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:44.452346
SID:	2814856
Source Port:	49767
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:18.460494
SID:	2814856
Source Port:	49746
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:20.615316
SID:	2814860
Source Port:	49747
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:45.834406
SID:	2814860
Source Port:	49768
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:18.891474
SID:	2814860
Source Port:	49746
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:44.884432
SID:	2814860
Source Port:	49767
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:48.969740
SID:	2033132
Source Port:	49772
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:51.602742
SID:	2033132
Source Port:	49773
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:13.273148
SID:	2033132
Source Port:	49794
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:45.548228
SID:	2814856
Source Port:	49768
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:19.967262
SID:	2814856
Source Port:	49747
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:11.794528
SID:	2814860
Source Port:	49742
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:55.152572
SID:	2033132
Source Port:	49776
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:16.319865
SID:	2033132
Source Port:	49797
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:41.053106
SID:	2814860
Source Port:	49763
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:55.856296
SID:	2033132
Source Port:	49777
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:17.553293
SID:	2033132
Source Port:	49798
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:39.529200
SID:	2814856
Source Port:	49884
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:36.522855
SID:	2814860
Source Port:	49880
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:45.146395
SID:	2033132
Source Port:	49890
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:20.191243
SID:	2814856
Source Port:	49863
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:21.448576
SID:	2814856
Source Port:	49864
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:06.751061
SID:	2825563
Source Port:	49708
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:41.834368
SID:	2814860
Source Port:	49764
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:40.773328
SID:	2814856
Source Port:	49885
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:00.599923
SID:	2814860
Source Port:	49781
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:55.255816
SID:	2814856
Source Port:	49733
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:28.595308
SID:	2814856
Source Port:	49811
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:31.946274
SID:	2814856
Source Port:	49815
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:58.807031
SID:	2033132
Source Port:	49841
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:13.727597
SID:	2814856
Source Port:	49857
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:38.602376
SID:	2033132
Source Port:	49883
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:23.905035
SID:	2033132
Source Port:	49721
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:46.588120
SID:	2814856
Source Port:	49891
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:35.868769
SID:	2814856
Source Port:	49819
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:14.159486
SID:	2814860
Source Port:	49857
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:21.492914
SID:	2033132
Source Port:	49803
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:27.083860
SID:	2825563
Source Port:	49722
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:28.896775
SID:	2814860
Source Port:	49811
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:02.928789
SID:	2033132
Source Port:	49845
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:42.332747
SID:	2033132
Source Port:	49887
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:14.978660
SID:	2033132
Source Port:	49718
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:24.764520
SID:	2033132
Source Port:	49807
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:47.203507
SID:	2814856
Source Port:	49770
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:55.537739
SID:	2814860
Source Port:	49733
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:00.305479
SID:	2814856
Source Port:	49781
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:42.055048
SID:	2814860
Source Port:	49825
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:32.131075
SID:	2814860
Source Port:	49815
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:55.943744
SID:	2033132
Source Port:	49838
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:06.400020
SID:	2033132
Source Port:	49849
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:47.349903
SID:	2814860
Source Port:	49829
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:59.761515
SID:	2825563
Source Port:	49842
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:35.568513
SID:	2033132
Source Port:	49725
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:36.224876
SID:	2814860
Source Port:	49819
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:47.693897
SID:	2814860
Source Port:	49770
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:11.366876
SID:	2814860
Source Port:	49791
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:53.067650
SID:	2825563
Source Port:	49732
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:31.506233
SID:	2825564
Source Port:	49814
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:53.177418
SID:	2814856
Source Port:	49774
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:28.205358
SID:	2814856
Source Port:	49753
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:50.849677
SID:	2814860
Source Port:	49895
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:10.702303
SID:	2814860
Source Port:	49853
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:26.925673
SID:	2814860
Source Port:	49870
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:30.248591
SID:	2814860
Source Port:	49874
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:56.845268
SID:	2814856
Source Port:	49778
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:33.917088
SID:	2814856
Source Port:	49757
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:02.998716
SID:	2814860
Source Port:	49736
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:18.713451
SID:	2814856
Source Port:	49799
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:57.538120
SID:	2814860
Source Port:	49778
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:18.990701
SID:	2814860
Source Port:	49799
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:01.668227
SID:	2033132
Source Port:	49783
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:39.324160
SID:	2033132
Source Port:	49762
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:02.785046
SID:	2814856
Source Port:	49736
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:53.395668
SID:	2814860
Source Port:	49774
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:14.818660
SID:	2814860
Source Port:	49795
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:28.420220
SID:	2814860
Source Port:	49753
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:49:05.632262
SID:	2033132
Source Port:	49787
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:46.848889
SID:	2814860
Source Port:	49891
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:48:43.118587
SID:	2033132
Source Port:	49766
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:49.844906
SID:	2814856
Source Port:	49895
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) - Source IP: 192.168.2.5 - Destination IP: 3.125.102.39

Timestamp:	04/25/24-00:50:10.254875
SID:	2814856
Source Port:	49853
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) - Source IP: 192.168.2.5 - Destination IP: 3.124.142.205

Timestamp:	04/25/24-00:47:17.931482
SID:	2825563
Source Port:	49719
Destination Port:	12143
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: jpGSWjSTSw.exe

Avira: detected

Antivirus detection for URL or domain

Source: 0.tcp.eu.ngrok.io

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp

Malware Configuration Extractor: Njrat {"Host": "0.tcp.eu.ngrok.io", "Port": "12143", "Version": "im523", "Campaign ID": "HacKed", "Install Name": "server.exe", "Install Dir": "TEMP"}

Multi AV Scanner detection for submitted file

Source: jpGSWjSTSw.exe

ReversingLabs: Detection: 94%

Yara detected Njrat

Source: Yara match	File source: jpGSWjSTSw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4421743474.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jpGSWjSTSw.exe PID: 5456, type: MEMORYSTR

Machine Learning detection for sample

Source: jpGSWjSTSw.exe

Joe Sandbox ML: detected

Source: jpGSWjSTSw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: jpGSWjSTSw.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: jpGSWjSTSw.exe, 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: jpGSWjSTSw.exe, 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: jpGSWjSTSw.exe, 00000000.00000002.4421743474.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: jpGSWjSTSw.exe, 00000000.00000002.4421743474.0000000002E61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: jpGSWjSTSw.exe	Binary or memory string: autorun.inf
Source: jpGSWjSTSw.exe	Binary or memory string: [autorun]

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49705 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49705 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49705 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49706 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49706 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49706 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49707 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49707 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49707 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49708 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49708 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49708 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49710 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49710 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49710 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49717 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49717 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49718 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49718 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49718 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49719 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49719 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49719 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49720 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49720 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49720 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49721 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49721 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49721 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49722 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49722 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49722 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49723 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49723 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49724 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49724 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49724 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49725 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49725 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49725 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49726 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49726 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49726 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49727 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49727 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49727 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49728 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49728 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49728 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49730 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49730 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49730 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49731 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49731 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49731 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49732 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49732 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49732 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49733 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49733 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49733 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49733 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49733 -> 3.124.142.205:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49734 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49734 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49734 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49734 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49734 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49735 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49735 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49736 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49736 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49736 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49737 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49737 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49737 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49738 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49738 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49738 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49739 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49739 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49740 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49740 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49742 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49742 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49742 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49743 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49743 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49744 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49744 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49745 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49745 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49746 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49746 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49746 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49747 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49747 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49747 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49748 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49748 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49748 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49749 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49749 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49749 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49750 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49750 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49751 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49751 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49752 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49752 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49752 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49753 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49753 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49753 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49754 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49754 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49754 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49755 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49755 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49755 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49756 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49756 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49757 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49757 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49758 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49758 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49758 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49759 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49759 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49759 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49760 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49760 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49760 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49761 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49761 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49761 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49762 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49762 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49762 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49763 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49763 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49763 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49764 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49764 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49764 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49765 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49765 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49765 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49765 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49766 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49766 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49766 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49767 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49767 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49767 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49768 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49768 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49768 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49769 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49769 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49769 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49770 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49770 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49770 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49771 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49771 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49771 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49771 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49772 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49772 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49772 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49772 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49772 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49773 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49773 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49773 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49773 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49774 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49774 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49774 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49775 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49775 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49775 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49776 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49776 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49776 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49777 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49777 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49777 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49778 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49778 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49778 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49779 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49779 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49779 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49780 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49780 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49780 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49781 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49781 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49781 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49781 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49782 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49782 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49782 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49783 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49783 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49783 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49784 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49784 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49784 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49785 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49785 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49785 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49786 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49786 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49786 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49787 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49787 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49787 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49788 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49788 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49788 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49788 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49789 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49789 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49789 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49790 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49790 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49790 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49791 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49791 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49791 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49792 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49792 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49792 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49793 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49793 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49793 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49794 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49794 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49794 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49795 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49795 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49795 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49796 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49796 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49796 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49797 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49797 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49798 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49798 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49798 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49799 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49799 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49799 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49799 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49800 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49800 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49800 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49801 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49801 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49801 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49802 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49802 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49802 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49803 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49803 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49803 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49804 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49804 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49804 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49805 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49805 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49805 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49806 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49806 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49806 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49806 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49807 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49807 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49808 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49808 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49808 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49809 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49809 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49809 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49810 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49810 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49810 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49811 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49811 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49811 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49812 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49812 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49812 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49813 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49813 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49813 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49814 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49814 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49814 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49814 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49815 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49815 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49815 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49816 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49816 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49816 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49817 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49817 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49817 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49818 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49818 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49818 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49819 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49819 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49819 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49820 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49820 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49820 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49820 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49821 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49821 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49821 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49822 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49822 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49822 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49823 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49823 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49823 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49824 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49824 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49824 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49824 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49825 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49825 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49825 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49825 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49826 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49826 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49826 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49827 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49827 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49827 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49828 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49828 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49828 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49829 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49829 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49829 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49830 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49830 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49830 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49831 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49831 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49831 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49832 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49832 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49832 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49833 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49833 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49833 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49834 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49834 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49834 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49835 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49835 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49835 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49836 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49836 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49836 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49837 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49837 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49837 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49838 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49838 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49838 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49839 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49839 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49839 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49840 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49840 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49840 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49841 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49841 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49841 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49841 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49842 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49842 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825563 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf) 192.168.2.5:49842 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49843 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49843 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49843 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49844 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49844 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49844 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49845 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49845 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49845 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49846 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49846 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49846 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49847 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49847 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49847 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49848 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49848 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49848 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49849 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49849 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49849 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49850 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49850 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49850 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49851 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49851 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49851 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49852 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49852 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49852 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49853 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49853 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49853 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49853 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49854 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49854 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49854 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49855 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49855 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49855 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49856 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49856 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49856 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49857 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49857 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49857 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49857 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49858 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49858 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49858 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49859 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49859 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49859 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49860 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49860 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49860 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49860 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49861 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49861 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49861 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49862 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49862 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49862 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49863 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49863 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49863 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49864 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49864 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49864 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49865 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49865 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49865 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49866 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49866 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49866 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49867 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49867 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49868 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49868 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49868 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2825564 ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act) 192.168.2.5:49868 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49869 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49869 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49869 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49870 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49870 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49870 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49871 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49871 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49871 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49872 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49872 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49872 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49873 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49873 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49873 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49874 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49874 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49875 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49875 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49875 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49876 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49876 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49876 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49877 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49877 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814860 ETPRO TROJAN njRAT/Bladabindi CnC Callback (act) 192.168.2.5:49877 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2033132 ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll) 192.168.2.5:49878 -> 3.125.102.39:12143
Source: Traffic	Snort IDS: 2814856 ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf) 192.168.2.5:49878 -> 3.125.102.39:12143

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 0.tcp.eu.ngrok.io

Source: global traffic	TCP traffic: 192.168.2.5:49705 -> 3.124.142.205:12143
Source: global traffic	TCP traffic: 192.168.2.5:49734 -> 3.125.102.39:12143

Source: Joe Sandbox View	IP Address: 3.124.142.205 3.124.142.205
Source: Joe Sandbox View	IP Address: 3.125.102.39 3.125.102.39

Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: 0.tcp.eu.ngrok.io

Source: jpGSWjSTSw.exe

String found in binary or memory: https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: jpGSWjSTSw.exe, kl.cs

.Net Code: VKCodeToUnicode

E-Banking Fraud

Yara detected Njrat

Source: Yara match	File source: jpGSWjSTSw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4421743474.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jpGSWjSTSw.exe PID: 5456, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: jpGSWjSTSw.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: jpGSWjSTSw.exe, type: SAMPLE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: jpGSWjSTSw.exe, type: SAMPLE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter
Source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects NjRAT / Bladabindi Author: ditekSHen
Source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 Author: unknown
Source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Identify njRat Author: Brian Wallace @botnet_hunter

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Code function: 0_2_00DBB3F6 NtQuerySystemInformation,		0_2_00DBB3F6
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Code function: 0_2_00DBB3BB NtQuerySystemInformation,		0_2_00DBB3BB

Source: jpGSWjSTSw.exe, 00000000.00000002.4421311837.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamemscorwks.dllT vs jpGSWjSTSw.exe

Source: jpGSWjSTSw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: jpGSWjSTSw.exe, type: SAMPLE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: jpGSWjSTSw.exe, type: SAMPLE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: jpGSWjSTSw.exe, type: SAMPLE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net
Source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_NjRAT author = ditekSHen, description = Detects NjRAT / Bladabindi
Source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Njrat_30f3c220 reference_sample = 741a0f3954499c11f9eddc8df7c31e7c59ca41f1a7005646735b8b1d53438c1b, os = windows, severity = x86, creation_date = 2021-06-13, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Njrat, fingerprint = d15e131bca6beddcaecb20fffaff1784ad8a33a25e7ce90f7450d1a362908cc4, id = 30f3c220-b8dc-45a1-bcf0-027c2f76fa63, last_modified = 2021-10-04
Source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: njrat1 date = 2015-05-27, author = Brian Wallace @botnet_hunter, description = Identify njRat, author_email = bwall@ballastsecurity.net

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/1@4/2

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Code function: 0_2_00DBB1B6 AdjustTokenPrivileges,		0_2_00DBB1B6
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Code function: 0_2_00DBB17F AdjustTokenPrivileges,		0_2_00DBB17F

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4764:120:WilError_03
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Mutant created: \Sessions\1\BaseNamedObjects\a84dc4708d9317c54957297ccf114c45
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: jpGSWjSTSw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: jpGSWjSTSw.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: jpGSWjSTSw.exe

ReversingLabs: Detection: 94%

Source: unknown	Process created: C:\Users\user\Desktop\jpGSWjSTSw.exe "C:\Users\user\Desktop\jpGSWjSTSw.exe"
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\jpGSWjSTSw.exe" "jpGSWjSTSw.exe" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\jpGSWjSTSw.exe" "jpGSWjSTSw.exe" ENABLE	Jump to behavior

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: jpGSWjSTSw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: jpGSWjSTSw.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: jpGSWjSTSw.exe, OK.cs

.Net Code: Plugin System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Code function: 0_2_057E0BFD push 69F5C360h; ret

0_2_057E0C12

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Memory allocated: F80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Memory allocated: 4E60000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Code function: 0_2_0130125B rdtsc

0_2_0130125B

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Window / User API: threadDelayed 3235	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Window / User API: threadDelayed 4943	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Window / User API: foregroundWindowGot 409	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Window / User API: foregroundWindowGot 1328	Jump to behavior

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe TID: 3608	Thread sleep count: 330 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe TID: 3608	Thread sleep time: -330000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe TID: 1964	Thread sleep count: 3235 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe TID: 3608	Thread sleep count: 4943 > 30	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe TID: 3608	Thread sleep time: -4943000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: jpGSWjSTSw.exe, 00000000.00000002.4421311837.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, netsh.exe, 00000002.00000003.2029081553.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Code function: 0_2_0130125B rdtsc

0_2_0130125B

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: jpGSWjSTSw.exe, kl.cs	Reference to suspicious API methods: MapVirtualKey(a, 0u)
Source: jpGSWjSTSw.exe, kl.cs	Reference to suspicious API methods: GetAsyncKeyState(num2)
Source: jpGSWjSTSw.exe, OK.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)

Source: jpGSWjSTSw.exe, 00000000.00000002.4421743474.000000000312D000.00000004.00000800.00020000.00000000.sdmp, jpGSWjSTSw.exe, 00000000.00000002.4421743474.00000000031F4000.00000004.00000800.00020000.00000000.sdmp, jpGSWjSTSw.exe, 00000000.00000002.4421743474.0000000003154000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: jpGSWjSTSw.exe, 00000000.00000002.4421743474.0000000003154000.00000004.00000800.00020000.00000000.sdmp, jpGSWjSTSw.exe, 00000000.00000002.4421743474.000000000310E000.00000004.00000800.00020000.00000000.sdmp, jpGSWjSTSw.exe, 00000000.00000002.4421743474.00000000030BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program managerL.
Source: jpGSWjSTSw.exe, 00000000.00000002.4421311837.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lfons\Program Managerl
Source: jpGSWjSTSw.exe, 00000000.00000002.4421055849.0000000000B76000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Program Managers
Source: jpGSWjSTSw.exe, 00000000.00000002.4421743474.000000000312D000.00000004.00000800.00020000.00000000.sdmp, jpGSWjSTSw.exe, 00000000.00000002.4421743474.0000000002ED3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: program manager
Source: jpGSWjSTSw.exe, 00000000.00000002.4421743474.000000000312D000.00000004.00000800.00020000.00000000.sdmp, jpGSWjSTSw.exe, 00000000.00000002.4421743474.00000000031F4000.00000004.00000800.00020000.00000000.sdmp, jpGSWjSTSw.exe, 00000000.00000002.4421743474.0000000003154000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager@9

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\jpGSWjSTSw.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the windows firewall

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\jpGSWjSTSw.exe" "jpGSWjSTSw.exe" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\Desktop\jpGSWjSTSw.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Users\user\Desktop\jpGSWjSTSw.exe" "jpGSWjSTSw.exe" ENABLE

Stealing of Sensitive Information

Yara detected Njrat

Source: Yara match	File source: jpGSWjSTSw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4421743474.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jpGSWjSTSw.exe PID: 5456, type: MEMORYSTR

Remote Access Functionality

Yara detected Njrat

Source: Yara match	File source: jpGSWjSTSw.exe, type: SAMPLE
Source: Yara match	File source: 0.0.jpGSWjSTSw.exe.7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4421743474.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jpGSWjSTSw.exe PID: 5456, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	2 Virtualization/Sandbox Evasion	1 Input Capture	11 Security Software Discovery	Remote Services	1 Input Capture	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	2 Process Injection	21 Disable or Modify Tools	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
jpGSWjSTSw.exe	95%	ReversingLabs	ByteCode-MSIL.Backdoor.Ratenjay
jpGSWjSTSw.exe	100%	Avira	TR/ATRAPS.Gen
jpGSWjSTSw.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
0.tcp.eu.ngrok.io	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
0.tcp.eu.ngrok.io	3.124.142.205	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
0.tcp.eu.ngrok.io	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dl.dropbox.com/s/p84aaz28t0hepul/Pass.exe?dl=0	jpGSWjSTSw.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
3.124.142.205	0.tcp.eu.ngrok.io	United States		16509	AMAZON-02US	true
3.125.102.39	unknown	United States		16509	AMAZON-02US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1431385
Start date and time:	2024-04-25 00:46:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	jpGSWjSTSw.exe renamed because original name is a hash value
Original Sample Name:	b1048f879fa97d356045037bddc4add3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/1@4/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 85 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: jpGSWjSTSw.exe

Simulations

Behavior and APIs

Time	Type	Description
00:47:28	API Interceptor	726137x Sleep call for process: jpGSWjSTSw.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3.124.142.205	xaa.doc.docx	Get hash	malicious	CVE-2021-40444	Browse	259f-88-231-63-13.eu.ngrok.io/
3.125.102.39	8egiXe8bX1.exe	Get hash	malicious	RedLine	Browse	0.tcp.eu.ngrok.io:18950/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
0.tcp.eu.ngrok.io	KvS2rT08PQ.exe	Get hash	malicious	Blank Grabber, Njrat, Umbral Stealer	Browse	18.158.249.75
	lLX6Po7hFJ.exe	Get hash	malicious	Nanocore	Browse	3.125.223.134
	aXDh3Stgy2.exe	Get hash	malicious	Njrat	Browse	18.158.249.75
	9VnALqFMbF.exe	Get hash	malicious	DarkComet	Browse	3.125.209.94
	AKsHpy5O2W.exe	Get hash	malicious	Njrat	Browse	3.125.223.134
	D6p5mclMzu.exe	Get hash	malicious	Njrat	Browse	3.124.142.205
	P1Oyl92c7q.exe	Get hash	malicious	Njrat	Browse	3.124.142.205
	F1RBq1AGOt.exe	Get hash	malicious	Njrat	Browse	3.125.209.94
	8egiXe8bX1.exe	Get hash	malicious	RedLine	Browse	3.125.102.39
	hIn6sixPtb.exe	Get hash	malicious	Njrat	Browse	3.124.142.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	https://goxdgdb.cn/	Get hash	malicious	Unknown	Browse	18.179.225.37
	https://x9mihc.cn/	Get hash	malicious	Unknown	Browse	54.199.132.115
	https://zgmskjr.cn/	Get hash	malicious	Unknown	Browse	54.199.132.115
	http://pengoodet.live	Get hash	malicious	Unknown	Browse	18.238.192.64
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSPyltUaWCsyFq200Ntb2JspVnELOGgvw66FVBJMc1CsMmns0_-2BOVhbrxcsvz9veeoLEglpD8RiEh0AaH1ow0Lk-2FKx9DGH2EA0fWhnrHZ-2FmlnIJ5UhAxXtDoOWXX-2FPyG5rVAl4UI7bgryXtRxONxX47M69Zs408-2BvnAL8-2FwQfC38J0vo-2BNPuXd9ZQRl3mVPkcpfDB8fFzO8k72NDbDigQEVVlq88Cbyd-2FspyzvoVJPR1h-2FbZ7QQ6McqmPE9-2BcpXmxMjtiMnlH5y7my6ciUJ8oawjrr8uTV2VFCUnRz-2BYajHpdlo-2BdijTTWoN6XIqzSzzn9raVdyCv6yrtMzJIVFFK229s6J0zoOHuRdvwd4zEdpENbxbzehqnKQ8Yk3LeuEYUlsDIufaiekHtd-2BWbkmha56OPiK-2BI-3D	Get hash	malicious	HTMLPhisher	Browse	3.163.125.15
	https://clicks.aweber.com/y/ct/?l=irQzWw&m=hE2OWd5T.UYPuTr&b=hqint4ojZ0QPjD7.f4mxDg#Ym5hbmRlcnNvbkBwcmVzaWRpby5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.226.210.57
	http://electricalsworksflorida.com/j6u	Get hash	malicious	HTMLPhisher	Browse	75.2.57.54
	https://gamma.app/docs/Shared-Document-9j9g6z8iqo1w0uu	Get hash	malicious	HTMLPhisher	Browse	216.137.39.128
	http://www.parishe-file.com	Get hash	malicious	Unknown	Browse	52.85.39.16
	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://control.mailblaze.com/index.php/survey/ps97367sjy584	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	54.241.215.97
AMAZON-02US	https://goxdgdb.cn/	Get hash	malicious	Unknown	Browse	18.179.225.37
	https://x9mihc.cn/	Get hash	malicious	Unknown	Browse	54.199.132.115
	https://zgmskjr.cn/	Get hash	malicious	Unknown	Browse	54.199.132.115
	http://pengoodet.live	Get hash	malicious	Unknown	Browse	18.238.192.64
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSPyltUaWCsyFq200Ntb2JspVnELOGgvw66FVBJMc1CsMmns0_-2BOVhbrxcsvz9veeoLEglpD8RiEh0AaH1ow0Lk-2FKx9DGH2EA0fWhnrHZ-2FmlnIJ5UhAxXtDoOWXX-2FPyG5rVAl4UI7bgryXtRxONxX47M69Zs408-2BvnAL8-2FwQfC38J0vo-2BNPuXd9ZQRl3mVPkcpfDB8fFzO8k72NDbDigQEVVlq88Cbyd-2FspyzvoVJPR1h-2FbZ7QQ6McqmPE9-2BcpXmxMjtiMnlH5y7my6ciUJ8oawjrr8uTV2VFCUnRz-2BYajHpdlo-2BdijTTWoN6XIqzSzzn9raVdyCv6yrtMzJIVFFK229s6J0zoOHuRdvwd4zEdpENbxbzehqnKQ8Yk3LeuEYUlsDIufaiekHtd-2BWbkmha56OPiK-2BI-3D	Get hash	malicious	HTMLPhisher	Browse	3.163.125.15
	https://clicks.aweber.com/y/ct/?l=irQzWw&m=hE2OWd5T.UYPuTr&b=hqint4ojZ0QPjD7.f4mxDg#Ym5hbmRlcnNvbkBwcmVzaWRpby5jb20=	Get hash	malicious	HTMLPhisher	Browse	13.226.210.57
	http://electricalsworksflorida.com/j6u	Get hash	malicious	HTMLPhisher	Browse	75.2.57.54
	https://gamma.app/docs/Shared-Document-9j9g6z8iqo1w0uu	Get hash	malicious	HTMLPhisher	Browse	216.137.39.128
	http://www.parishe-file.com	Get hash	malicious	Unknown	Browse	52.85.39.16
	https://content.amanet.org/?m=CiGW.81UwlU3LD6ZH5M4ZoUXv03dAeWfC&r=https://control.mailblaze.com/index.php/survey/ps97367sjy584	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	54.241.215.97

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.57705929211832
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	jpGSWjSTSw.exe
File size:	37'888 bytes
MD5:	b1048f879fa97d356045037bddc4add3
SHA1:	5e4a581b9756c930af7f0f07020fa668e1ec7143
SHA256:	3708d1bd614bd0a96c34dc96c7ef75bb6386b401b6e81b019293a8964447c90a
SHA512:	770fba138942174b55982a5c69e8c97d17eeab6a23cb05fbccc28cf2754a6b006d43e2d07edf55990210f0e5d7ec87543b182e648ec8b76e57a7b354eb406f5b
SSDEEP:	384:mmZ+vEiTbZvpWNcZ0y8f1CRDX5CLk6SiprAF+rMRTyN/0L+EcoinblneHQM3epzy:n+dTZ38f1CRDcNSerM+rMRa8Nu4Rt
TLSH:	52032A4D7FE18168C5FD067B05B2D41207BAE04B6E23D91E8EF664EA37636C18B50AF1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...A.$f................................. ........@.. ....................................@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40abbe
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66241241 [Sat Apr 20 19:06:41 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xab6c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x240	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x8bc4	0x8c00	2e26680a42e72dd0fadbcc565a0a5209	False	0.4636160714285714	data	5.608829095469957	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x240	0x400	f7ce2f7b506ce16c06c85a549ef2cd98	False	0.3134765625	data	4.968771659524424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	163d66697186c0743c0da6f82247a39a	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc058	0x1e7	XML 1.0 document, ASCII text, with CRLF line terminators			0.5338809034907598

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/25/24-00:49:14.492455	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49795	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:13.487235	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49794	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:12.820590	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49793	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:09.631966	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49790	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:11.801460	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49792	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:10.518340	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49791	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:04.144544	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49785	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:05.117481	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49786	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:07.225396	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49788	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:05.846152	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49787	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:08.962859	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49789	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:06.488485	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49787	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:09.194933	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49789	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:07.439855	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49788	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:04.678135	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49785	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:05.414058	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49786	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:59.865750	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49780	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:03.709538	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49784	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:49.235388	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49894	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:54.832997	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49898	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:01.443867	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49782	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:47.290539	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49892	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:19.216442	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49800	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:20.694990	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49802	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:45.363214	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49890	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:55.262949	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49898	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:03.161317	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49784	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:51.818325	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49773	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:26.217596	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49808	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:01.034041	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49782	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:48.129955	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49771	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:58.977189	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49780	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:22.367152	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49804	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:24.126808	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49806	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:10.084381	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49790	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:12.381302	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49792	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:52.849891	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49773	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:14.053075	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49794	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:48.740558	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49771	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:49.409574	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49894	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:15.254451	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49796	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:48.127008	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49892	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:54.026421	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49775	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:56.071957	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49777	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:17.768087	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49798	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:58.428158	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49779	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:18.272444	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49798	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:57.973481	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49779	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:56.412799	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49777	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:46.155660	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49890	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:16.099908	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49796	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:54.929224	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49775	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:51.181362	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49896	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:31.504362	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49876	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:30.685115	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49875	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:40.257198	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49762	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:07.008677	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49788	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:08.747793	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49789	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:28.271247	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49872	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:34.441584	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49879	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:38.833719	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49761	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:00.819507	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49782	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:37.335616	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49821	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:38.614370	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49822	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:00.599923	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49781	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:00.088013	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49781	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:31.071312	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49875	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:32.308248	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49876	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:01.009601	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49706	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:35.652450	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49819	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:46.323695	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49829	12143	192.168.2.5	3.125.102.39
04/25/24-00:46:57.885770	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49705	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:25.812583	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49751	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:39.540590	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49762	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:38.188784	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49761	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:31.730194	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49815	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:22.146852	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49803	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:41.373666	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49825	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:43.536037	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49826	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:32.351209	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49816	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:24.523020	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49806	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:48.798631	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49893	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:20.910124	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49802	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:22.023774	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49865	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:22.700008	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49866	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:57.758029	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49779	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:41.635506	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49886	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:56.630895	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49778	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:18.496969	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49799	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:42.545910	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49887	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:38.816417	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49883	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:18.640802	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49861	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:25.512110	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49869	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:38.223177	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49882	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:21.708124	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49803	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:48.740558	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49771	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:28.381325	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49811	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:50.963248	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49896	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:49.508535	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49832	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:50.800930	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49833	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:47.914116	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49771	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:49.627002	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49772	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:11.586072	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49792	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:49.627911	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49895	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:46.989329	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49770	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:10.303680	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49791	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:24.343699	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49806	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:23.287546	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49866	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:43.226792	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49887	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:21.271785	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49802	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:42.114011	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49886	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:49.188492	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49772	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:24.980519	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49807	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:29.114643	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49812	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:22.263133	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49865	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:19.757886	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49862	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:38.384394	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49882	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:03.928617	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49707	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:42.265849	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49765	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:24.523020	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49806	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:01.227381	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49706	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:43.332834	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49766	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:14.642145	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49744	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:46.771894	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49769	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:18.843017	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49861	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:17.200892	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49745	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:39.097115	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49883	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:21.801758	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49748	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:52.961389	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49774	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:14.273815	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49795	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:46.267043	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49769	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:44.008650	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49766	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:47.074202	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49892	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:19.279792	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49862	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:53.810808	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49775	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:15.038634	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49796	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:46.373858	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49891	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:42.897252	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49765	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:23.329438	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49749	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:12.036590	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49855	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:50.363474	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49731	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:29.987743	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49813	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:45.332773	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49768	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:54.124278	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49897	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:42.897252	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49765	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:02.725444	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49783	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:48.568645	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49893	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:01.034235	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49843	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:40.557828	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49885	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:36.837180	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49760	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:21.193171	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49720	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:22.233811	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49748	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:30.834319	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49813	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:15.244343	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49859	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:33.830327	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49817	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:12.317794	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49855	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:44.209383	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49889	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:54.399333	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49897	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:20.085427	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49801	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:01.885480	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49783	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:41.601384	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49727	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:49.188492	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49772	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:04.507433	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49847	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:53.850267	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49836	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:29.802259	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49723	12143	192.168.2.5	3.124.142.205
04/25/24-00:50:26.012163	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49869	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:23.328512	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49805	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:34.162345	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49817	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:16.066012	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49859	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:45.287359	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49827	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:42.114011	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49886	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:27.162480	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49809	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:49.627002	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49772	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:13.053063	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49793	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:47.546665	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49730	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:36.220154	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49759	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:07.054780	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49738	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:08.764388	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49851	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:48.798631	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49893	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:48.318567	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49830	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:55.366936	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49776	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:30.725768	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49755	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:58.707738	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49734	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:28.482374	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49872	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:36.005501	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49759	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:30.942694	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49755	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:03.929746	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49785	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:58.921720	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49734	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:47.787361	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49830	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:08.262223	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49851	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:36.747530	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49881	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:41.273956	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49764	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:55.624037	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49776	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:17.334361	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49797	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:06.625779	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49738	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:13.049981	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49743	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:09.364361	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49710	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:21.585946	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49748	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:49.726668	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49832	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:51.975735	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49834	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:18.244215	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49746	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:16.985233	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49745	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:23.116308	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49749	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:51.013123	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49833	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:55.364597	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49837	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:16.281870	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49860	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:18.425768	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49861	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:54.064458	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49836	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:19.064775	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49862	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:12.532093	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49717	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:19.750801	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49747	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:53.268900	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49835	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:21.234586	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49864	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:19.976915	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49863	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:21.810842	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49865	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:53.631192	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49835	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:52.834433	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49834	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:23.507279	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49867	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:25.083870	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49868	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:56.157929	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49838	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:50.584197	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49832	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:22.483591	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49866	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:51.537309	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49833	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:57.003292	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49839	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:24.222070	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49868	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:25.299879	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49869	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:14.378165	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49858	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:52.852185	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49732	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:54.927960	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49836	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:05.240470	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49847	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:55.040157	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49733	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:55.724852	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49837	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:06.180507	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49848	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:15.028075	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49859	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:15.194657	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49718	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:56.568726	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49838	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:07.118610	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49849	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:10.702303	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49853	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:03.928617	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49707	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:17.931482	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49719	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:57.849869	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49839	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:06.751061	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49708	12143	192.168.2.5	3.124.142.205
04/25/24-00:50:17.205300	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49860	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:24.121861	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49721	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:39.472335	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49823	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:04.413544	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49737	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:06.411435	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49738	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:33.702642	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49757	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:35.790974	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49759	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:01.248018	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49843	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:03.145932	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49845	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:58.707738	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49734	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:00.711821	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49735	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:08.338010	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49739	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:27.083860	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49722	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:38.828297	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49822	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:43.749275	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49826	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:58.921720	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49734	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:31.533275	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49756	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:01.878885	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49844	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:05.677206	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49848	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:27.144262	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49871	12143	192.168.2.5	3.125.102.39
04/25/24-00:46:58.101854	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49705	12143	192.168.2.5	3.124.142.205
04/25/24-00:50:04.722520	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49847	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:07.336000	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49850	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:41.816992	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49727	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:41.589318	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49825	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:02.571086	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49736	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:28.058043	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49872	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:28.702815	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49873	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:21.193171	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49720	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:44.738721	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49728	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:40.427505	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49824	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:01.227381	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49706	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:34.582567	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49758	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:03.774478	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49846	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:08.049827	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49851	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:47.333096	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49730	12143	192.168.2.5	3.124.142.205
04/25/24-00:50:29.611673	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49874	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:30.470374	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49875	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:08.982610	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49852	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:10.923828	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49854	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:39.062267	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49726	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:50.149111	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49731	12143	192.168.2.5	3.124.142.205
04/25/24-00:50:04.287324	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49846	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:41.148587	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49824	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:10.040349	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49853	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:13.509872	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49857	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:35.782511	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49725	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:44.425673	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49827	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:03.334339	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49845	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:33.301819	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49878	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:39.990511	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49823	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:06.615743	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49849	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:12.534157	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49856	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:30.015631	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49723	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:46.538707	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49829	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:01.443589	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49843	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:31.290147	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49876	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:32.527377	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49877	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:32.871207	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49724	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:45.724279	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49828	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:02.709201	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49844	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:39.037374	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49822	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:11.822550	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49855	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:39.062267	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49726	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:59.287121	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49841	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:35.782511	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49725	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:41.816992	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49727	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:38.381115	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49821	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:32.871207	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49724	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:44.738721	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49728	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:37.115508	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49820	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:24.553737	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49750	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:58.474842	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49840	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:25.599228	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49751	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:26.665270	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49752	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:58.289236	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49840	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:58.493730	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49734	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:26.230488	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49870	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:27.991179	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49753	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:30.509063	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49755	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:59.021314	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49841	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:37.549532	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49821	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:36.663946	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49820	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:29.176543	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49754	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:59.761515	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49842	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:53.067650	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49732	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:29.328158	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49812	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:11.139614	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49854	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:12.747197	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49856	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:44.234537	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49767	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:38.007019	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49882	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:07.549051	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49850	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:14.590649	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49858	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:47.546665	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49730	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:31.266597	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49814	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:39.314933	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49884	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:58.072537	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49840	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:46.053331	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49769	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:41.420661	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49886	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:23.753410	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49749	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:59.546636	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49842	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:03.558976	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49846	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:20.976512	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49720	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:32.567051	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49816	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:13.291521	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49856	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:24.121861	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49721	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:29.541494	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49812	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:34.596766	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49818	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:11.603965	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49854	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:43.447027	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49888	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:01.663492	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49844	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:10.098611	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49740	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:56.789226	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49839	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:12.320005	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49717	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:32.659515	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49724	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:44.523905	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49728	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:55.149016	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49837	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:34.227676	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49879	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:31.506233	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49814	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:14.803337	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49858	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:05.461550	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49848	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:17.718164	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49719	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:26.868566	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49722	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:43.962568	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49826	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:33.396962	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49816	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:35.428022	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49818	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:59.287121	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49841	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:46.099899	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49828	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:38.848060	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49726	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:05.056129	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49737	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:50.363474	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49731	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:55.537739	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49733	12143	192.168.2.5	3.124.142.205
04/25/24-00:47:55.255816	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49733	12143	192.168.2.5	3.124.142.205
04/25/24-00:50:14.159486	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49857	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:09.364361	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49710	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:26.879013	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49752	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:09.822015	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49852	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:28.162403	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49810	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:27.840411	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49871	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:29.393049	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49873	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:29.389230	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49754	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:49.287560	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49831	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:00.925612	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49735	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:31.747522	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49756	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:35.220747	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49758	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:07.831931	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49850	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:37.975113	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49761	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:08.554832	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49739	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:09.884956	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49740	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:04.628463	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49737	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:11.366803	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49742	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:34.795306	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49758	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:02.947238	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49784	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:40.481182	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49763	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:14.428999	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49744	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:27.307162	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49752	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:04.900338	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49786	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:09.197409	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49852	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:28.920114	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49873	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:15.194657	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49718	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:29.814769	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49754	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:27.987573	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49810	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:35.843702	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49880	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:48.756385	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49831	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:42.051762	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49765	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:37.480364	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49760	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:32.742537	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49877	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:07.439855	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49788	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:27.359317	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49871	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:26.444726	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49870	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:33.516119	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49878	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:58.764150	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49780	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:36.448488	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49820	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:40.210389	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49824	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:41.148587	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49824	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:42.055048	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49825	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:33.083825	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49877	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:39.258468	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49823	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:03.715256	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49707	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:24.766062	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49750	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:33.616044	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49817	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:45.509058	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49828	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:34.383362	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49818	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:37.051475	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49760	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:06.537404	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49708	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:23.100225	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49804	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:23.764200	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49805	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:44.211236	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49827	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:37.115508	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49820	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:26.944028	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49808	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:27.553190	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49809	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:43.661365	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49888	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:19.431498	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49800	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:22.582932	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49804	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:20.300717	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49801	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:23.542679	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49805	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:18.990701	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49799	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:46.848889	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49891	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:48.351920	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49893	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:36.963258	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49881	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:49.018636	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49894	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:47.572745	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49830	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:16.495093	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49860	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:24.436209	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49868	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:44.421982	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49889	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:12.605213	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49793	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:09.148778	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49710	12143	192.168.2.5	3.124.142.205
04/25/24-00:50:53.907170	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49897	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:52.251764	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49773	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:26.433620	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49808	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:29.771873	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49813	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:25.083870	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49868	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:44.923890	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49889	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:48.539898	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49831	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:53.054853	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49835	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:27.376660	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49809	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:27.772719	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49810	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:31.052671	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49814	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:24.003773	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49867	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:09.415691	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49790	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:43.993051	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49888	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:54.618364	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49898	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:19.865582	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49800	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:20.474948	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49801	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:51.757544	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49834	12143	192.168.2.5	3.125.102.39
04/25/24-00:46:58.101854	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49705	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:40.694841	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49763	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:11.580619	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49742	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:40.339039	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49884	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:17.205300	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49860	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:21.591654	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49864	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:41.200957	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49885	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:41.490643	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49764	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:21.015231	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49863	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:13.267711	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49743	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:37.780662	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49881	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:44.452346	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49767	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:18.460494	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49746	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:20.615316	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49747	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:45.834406	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49768	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:18.891474	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49746	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:44.884432	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49767	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:48.969740	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49772	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:51.602742	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49773	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:13.273148	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49794	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:45.548228	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49768	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:19.967262	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49747	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:11.794528	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49742	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:55.152572	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49776	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:16.319865	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49797	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:41.053106	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49763	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:55.856296	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49777	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:17.553293	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49798	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:39.529200	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49884	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:36.522855	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49880	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:45.146395	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49890	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:20.191243	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49863	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:21.448576	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49864	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:06.751061	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49708	12143	192.168.2.5	3.124.142.205
04/25/24-00:48:41.834368	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49764	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:40.773328	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49885	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:00.599923	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49781	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:55.255816	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49733	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:28.595308	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49811	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:31.946274	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49815	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:58.807031	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49841	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:13.727597	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49857	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:38.602376	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49883	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:23.905035	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49721	12143	192.168.2.5	3.124.142.205
04/25/24-00:50:46.588120	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49891	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:35.868769	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49819	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:14.159486	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49857	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:21.492914	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49803	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:27.083860	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49722	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:28.896775	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49811	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:02.928789	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49845	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:42.332747	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49887	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:14.978660	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49718	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:24.764520	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49807	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:47.203507	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49770	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:55.537739	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49733	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:00.305479	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49781	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:42.055048	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49825	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:32.131075	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49815	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:55.943744	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49838	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:06.400020	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49849	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:47.349903	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49829	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:59.761515	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49842	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:35.568513	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49725	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:36.224876	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49819	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:47.693897	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49770	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:11.366876	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49791	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:53.067650	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49732	12143	192.168.2.5	3.124.142.205
04/25/24-00:49:31.506233	TCP	2825564	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (act)	49814	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:53.177418	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49774	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:28.205358	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49753	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:50.849677	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49895	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:10.702303	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49853	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:26.925673	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49870	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:30.248591	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49874	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:56.845268	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49778	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:33.917088	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49757	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:02.998716	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49736	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:18.713451	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49799	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:57.538120	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49778	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:18.990701	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49799	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:01.668227	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49783	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:39.324160	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49762	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:02.785046	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49736	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:53.395668	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49774	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:14.818660	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49795	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:28.420220	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49753	12143	192.168.2.5	3.125.102.39
04/25/24-00:49:05.632262	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49787	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:46.848889	TCP	2814860	ETPRO TROJAN njRAT/Bladabindi CnC Callback (act)	49891	12143	192.168.2.5	3.125.102.39
04/25/24-00:48:43.118587	TCP	2033132	ET TROJAN Generic njRAT/Bladabindi CnC Activity (ll)	49766	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:49.844906	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49895	12143	192.168.2.5	3.125.102.39
04/25/24-00:50:10.254875	TCP	2814856	ETPRO TROJAN njrat ver 0.7d Malware CnC Callback (inf)	49853	12143	192.168.2.5	3.125.102.39
04/25/24-00:47:17.931482	TCP	2825563	ETPRO TROJAN Generic njRAT/Bladabindi CnC Activity (inf)	49719	12143	192.168.2.5	3.124.142.205

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 00:46:57.577270985 CEST	49705	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:46:57.793338060 CEST	12143	49705	3.124.142.205	192.168.2.5
Apr 25, 2024 00:46:57.793519020 CEST	49705	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:46:57.885770082 CEST	49705	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:46:58.101773977 CEST	12143	49705	3.124.142.205	192.168.2.5
Apr 25, 2024 00:46:58.101854086 CEST	49705	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:46:58.317708015 CEST	12143	49705	3.124.142.205	192.168.2.5
Apr 25, 2024 00:46:58.775618076 CEST	12143	49705	3.124.142.205	192.168.2.5
Apr 25, 2024 00:46:58.775712967 CEST	49705	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:00.788556099 CEST	49705	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:00.790766001 CEST	49706	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:01.004575014 CEST	12143	49705	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:01.006546974 CEST	12143	49706	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:01.006652117 CEST	49706	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:01.009601116 CEST	49706	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:01.227289915 CEST	12143	49706	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:01.227380991 CEST	49706	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:01.443098068 CEST	12143	49706	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:01.479250908 CEST	12143	49706	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:01.479365110 CEST	49706	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:03.491151094 CEST	49706	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:03.492475033 CEST	49707	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:03.706609011 CEST	12143	49707	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:03.706818104 CEST	49707	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:03.707644939 CEST	12143	49706	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:03.715255976 CEST	49707	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:03.928546906 CEST	12143	49707	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:03.928617001 CEST	49707	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:04.141988039 CEST	12143	49707	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:04.226001024 CEST	12143	49707	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:04.226092100 CEST	49707	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:06.318819046 CEST	49707	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:06.320067883 CEST	49708	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:06.532330990 CEST	12143	49707	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:06.533560991 CEST	12143	49708	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:06.533663988 CEST	49708	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:06.537404060 CEST	49708	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:06.750920057 CEST	12143	49708	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:06.751060963 CEST	49708	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:06.923372030 CEST	12143	49708	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:06.923451900 CEST	49708	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:06.964497089 CEST	12143	49708	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:07.137069941 CEST	12143	49708	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:08.929472923 CEST	49710	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:09.144552946 CEST	12143	49710	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:09.144712925 CEST	49710	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:09.148777962 CEST	49710	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:09.364305019 CEST	12143	49710	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:09.364361048 CEST	49710	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:09.579021931 CEST	12143	49710	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:10.097899914 CEST	12143	49710	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:10.097995043 CEST	49710	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:12.101073980 CEST	49710	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:12.103147984 CEST	49717	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:12.315180063 CEST	12143	49717	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:12.315274954 CEST	49717	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:12.315948963 CEST	12143	49710	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:12.320004940 CEST	49717	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:12.532020092 CEST	12143	49717	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:12.532093048 CEST	49717	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:12.744364977 CEST	12143	49717	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:12.750539064 CEST	12143	49717	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:12.750597954 CEST	49717	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:14.758476973 CEST	49717	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:14.760171890 CEST	49718	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:14.971703053 CEST	12143	49717	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:14.975713015 CEST	12143	49718	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:14.975858927 CEST	49718	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:14.978660107 CEST	49718	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:15.194395065 CEST	12143	49718	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:15.194657087 CEST	49718	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:15.410265923 CEST	12143	49718	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:15.483165026 CEST	12143	49718	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:15.483329058 CEST	49718	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:17.499481916 CEST	49718	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:17.501333952 CEST	49719	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:17.714677095 CEST	12143	49719	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:17.714869022 CEST	49719	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:17.714937925 CEST	12143	49718	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:17.718163967 CEST	49719	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:17.931375980 CEST	12143	49719	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:17.931482077 CEST	49719	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:18.144427061 CEST	12143	49719	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:18.740755081 CEST	12143	49719	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:18.740839958 CEST	49719	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:20.756405115 CEST	49719	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:20.757541895 CEST	49720	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:20.970756054 CEST	12143	49719	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:20.973788023 CEST	12143	49720	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:20.973880053 CEST	49720	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:20.976511955 CEST	49720	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:21.192944050 CEST	12143	49720	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:21.193171024 CEST	49720	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:21.409542084 CEST	12143	49720	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:21.473093033 CEST	12143	49720	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:21.473206997 CEST	49720	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:23.671679020 CEST	49720	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:23.687899113 CEST	49721	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:23.887965918 CEST	12143	49720	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:23.902297020 CEST	12143	49721	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:23.902406931 CEST	49721	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:23.905035019 CEST	49721	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:24.121762037 CEST	12143	49721	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:24.121860981 CEST	49721	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:24.337481022 CEST	12143	49721	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:24.633928061 CEST	12143	49721	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:24.634080887 CEST	49721	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:26.647180080 CEST	49721	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:26.648430109 CEST	49722	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:26.862867117 CEST	12143	49721	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:26.865156889 CEST	12143	49722	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:26.865269899 CEST	49722	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:26.868566036 CEST	49722	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:27.083756924 CEST	12143	49722	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:27.083859921 CEST	49722	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:27.299388885 CEST	12143	49722	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:27.581222057 CEST	12143	49722	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:27.581348896 CEST	49722	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:29.584649086 CEST	49722	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:29.586018085 CEST	49723	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:29.799324036 CEST	12143	49723	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:29.799427032 CEST	49723	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:29.799875975 CEST	12143	49722	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:29.802258968 CEST	49723	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:30.015533924 CEST	12143	49723	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:30.015630960 CEST	49723	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:30.229022980 CEST	12143	49723	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:30.443036079 CEST	12143	49723	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:30.443236113 CEST	49723	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:32.443804026 CEST	49723	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:32.444983006 CEST	49724	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:32.656672955 CEST	12143	49724	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:32.656765938 CEST	49724	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:32.657263994 CEST	12143	49723	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:32.659514904 CEST	49724	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:32.871105909 CEST	12143	49724	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:32.871206999 CEST	49724	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:33.082977057 CEST	12143	49724	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:33.349431038 CEST	12143	49724	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:33.349680901 CEST	49724	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:35.350056887 CEST	49724	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:35.351579905 CEST	49725	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:35.563107967 CEST	12143	49724	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:35.565677881 CEST	12143	49725	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:35.565777063 CEST	49725	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:35.568512917 CEST	49725	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:35.782433033 CEST	12143	49725	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:35.782510996 CEST	49725	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:35.995846033 CEST	12143	49725	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:36.587480068 CEST	12143	49725	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:36.587615013 CEST	49725	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:38.600055933 CEST	49725	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:38.601624012 CEST	49726	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:38.813935995 CEST	12143	49725	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:38.815428972 CEST	12143	49726	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:38.815531015 CEST	49726	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:38.848059893 CEST	49726	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:39.062091112 CEST	12143	49726	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:39.062267065 CEST	49726	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:39.276089907 CEST	12143	49726	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:39.376152039 CEST	12143	49726	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:39.376240969 CEST	49726	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:41.381321907 CEST	49726	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:41.382899046 CEST	49727	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:41.595163107 CEST	12143	49726	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:41.598381996 CEST	12143	49727	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:41.598475933 CEST	49727	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:41.601383924 CEST	49727	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:41.816869974 CEST	12143	49727	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:41.816992044 CEST	49727	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:42.032522917 CEST	12143	49727	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:42.298368931 CEST	12143	49727	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:42.298521996 CEST	49727	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:44.303168058 CEST	49727	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:44.304378986 CEST	49728	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:44.518759012 CEST	12143	49727	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:44.520040035 CEST	12143	49728	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:44.520124912 CEST	49728	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:44.523905039 CEST	49728	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:44.738622904 CEST	12143	49728	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:44.738720894 CEST	49728	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:44.953454018 CEST	12143	49728	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:45.234899044 CEST	12143	49728	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:45.235145092 CEST	49728	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:47.115703106 CEST	49728	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:47.117113113 CEST	49730	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:47.330540895 CEST	12143	49728	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:47.330709934 CEST	12143	49730	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:47.330815077 CEST	49730	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:47.333096027 CEST	49730	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:47.546552896 CEST	12143	49730	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:47.546664953 CEST	49730	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:47.760319948 CEST	12143	49730	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:48.172534943 CEST	12143	49730	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:48.172662973 CEST	49730	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:49.928383112 CEST	49730	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:49.930898905 CEST	49731	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:50.142240047 CEST	12143	49730	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:50.144980907 CEST	12143	49731	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:50.145180941 CEST	49731	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:50.149111032 CEST	49731	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:50.363384008 CEST	12143	49731	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:50.363473892 CEST	49731	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:50.577790976 CEST	12143	49731	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:50.989326954 CEST	12143	49731	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:50.989415884 CEST	49731	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:52.631428003 CEST	49731	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:52.633101940 CEST	49732	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:52.845635891 CEST	12143	49731	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:52.848628998 CEST	12143	49732	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:52.848738909 CEST	49732	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:52.852185011 CEST	49732	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:53.067547083 CEST	12143	49732	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:53.067650080 CEST	49732	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:53.283023119 CEST	12143	49732	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:53.294564962 CEST	12143	49732	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:53.294627905 CEST	49732	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:54.818967104 CEST	49732	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:54.820887089 CEST	49733	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:55.034547091 CEST	12143	49732	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:55.036434889 CEST	12143	49733	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:55.036542892 CEST	49733	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:55.040157080 CEST	49733	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:55.255727053 CEST	12143	49733	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:55.255815983 CEST	49733	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:55.472254992 CEST	12143	49733	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:55.537739038 CEST	49733	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:55.753454924 CEST	12143	49733	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:55.898669004 CEST	12143	49733	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:55.898750067 CEST	49733	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:58.102920055 CEST	49733	12143	192.168.2.5	3.124.142.205
Apr 25, 2024 00:47:58.276241064 CEST	49734	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:47:58.318418980 CEST	12143	49733	3.124.142.205	192.168.2.5
Apr 25, 2024 00:47:58.490147114 CEST	12143	49734	3.125.102.39	192.168.2.5
Apr 25, 2024 00:47:58.490274906 CEST	49734	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:47:58.493730068 CEST	49734	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:47:58.707621098 CEST	12143	49734	3.125.102.39	192.168.2.5
Apr 25, 2024 00:47:58.707737923 CEST	49734	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:47:58.921633005 CEST	12143	49734	3.125.102.39	192.168.2.5
Apr 25, 2024 00:47:58.921720028 CEST	49734	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:47:59.135639906 CEST	12143	49734	3.125.102.39	192.168.2.5
Apr 25, 2024 00:47:59.155983925 CEST	12143	49734	3.125.102.39	192.168.2.5
Apr 25, 2024 00:47:59.156121016 CEST	49734	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:00.491013050 CEST	49734	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:00.495147943 CEST	49735	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:00.705257893 CEST	12143	49734	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:00.708827019 CEST	12143	49735	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:00.708959103 CEST	49735	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:00.711821079 CEST	49735	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:00.925478935 CEST	12143	49735	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:00.925611973 CEST	49735	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:01.105725050 CEST	12143	49735	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:01.105798960 CEST	49735	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:01.139522076 CEST	12143	49735	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:01.320161104 CEST	12143	49735	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:02.353240013 CEST	49736	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:02.566961050 CEST	12143	49736	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:02.567096949 CEST	49736	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:02.571085930 CEST	49736	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:02.784749985 CEST	12143	49736	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:02.785046101 CEST	49736	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:02.998644114 CEST	12143	49736	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:02.998716116 CEST	49736	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:03.038242102 CEST	12143	49736	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:03.038312912 CEST	49736	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:03.212372065 CEST	12143	49736	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:03.251873016 CEST	12143	49736	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:04.195215940 CEST	49737	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:04.408896923 CEST	12143	49737	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:04.409020901 CEST	49737	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:04.413543940 CEST	49737	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:04.628242016 CEST	12143	49737	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:04.628463030 CEST	49737	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:04.842190027 CEST	12143	49737	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:04.842375994 CEST	49737	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:05.056018114 CEST	12143	49737	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:05.056128979 CEST	49737	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:05.071695089 CEST	12143	49737	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:05.071813107 CEST	49737	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:05.269684076 CEST	12143	49737	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:05.285325050 CEST	12143	49737	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:06.194046021 CEST	49738	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:06.408376932 CEST	12143	49738	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:06.408628941 CEST	49738	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:06.411434889 CEST	49738	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:06.625549078 CEST	12143	49738	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:06.625778913 CEST	49738	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:06.839998960 CEST	12143	49738	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:06.840250969 CEST	49738	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:07.054485083 CEST	12143	49738	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:07.054780006 CEST	49738	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:07.109262943 CEST	12143	49738	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:07.112113953 CEST	49738	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:07.271970987 CEST	12143	49738	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:07.326217890 CEST	12143	49738	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:08.117615938 CEST	49739	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:08.333676100 CEST	12143	49739	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:08.333777905 CEST	49739	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:08.338010073 CEST	49739	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:08.554604053 CEST	12143	49739	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:08.554831982 CEST	49739	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:08.716216087 CEST	12143	49739	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:08.716360092 CEST	49739	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:08.770791054 CEST	12143	49739	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:08.932153940 CEST	12143	49739	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:09.664923906 CEST	49740	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:09.878571987 CEST	12143	49740	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:09.878664970 CEST	49740	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:09.884955883 CEST	49740	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:10.098519087 CEST	12143	49740	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:10.098611116 CEST	49740	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:10.257757902 CEST	12143	49740	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:10.257827044 CEST	49740	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:10.312231064 CEST	12143	49740	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:10.471383095 CEST	12143	49740	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:11.148932934 CEST	49742	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:11.362993002 CEST	12143	49742	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:11.363148928 CEST	49742	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:11.366802931 CEST	49742	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:11.580511093 CEST	12143	49742	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:11.580619097 CEST	49742	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:11.794401884 CEST	12143	49742	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:11.794528008 CEST	49742	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:12.000813961 CEST	12143	49742	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:12.000972033 CEST	49742	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:12.008223057 CEST	12143	49742	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:12.215023994 CEST	12143	49742	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:12.821697950 CEST	49743	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:13.041439056 CEST	12143	49743	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:13.041538954 CEST	49743	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:13.049981117 CEST	49743	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:13.265686989 CEST	12143	49743	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:13.267710924 CEST	49743	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:13.409404039 CEST	12143	49743	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:13.411498070 CEST	49743	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:13.483786106 CEST	12143	49743	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:13.627232075 CEST	12143	49743	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:14.195257902 CEST	49744	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:14.408477068 CEST	12143	49744	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:14.408705950 CEST	49744	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:14.428998947 CEST	49744	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:14.642016888 CEST	12143	49744	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:14.642144918 CEST	49744	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:14.855206966 CEST	12143	49744	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:14.895548105 CEST	12143	49744	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:14.895653963 CEST	49744	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:16.756280899 CEST	49744	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:16.758681059 CEST	49745	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:16.969393969 CEST	12143	49744	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:16.974212885 CEST	12143	49745	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:16.974334955 CEST	49745	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:16.985233068 CEST	49745	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:17.200721979 CEST	12143	49745	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:17.200891972 CEST	49745	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:17.345031023 CEST	12143	49745	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:17.345165014 CEST	49745	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:17.416481018 CEST	12143	49745	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:17.561250925 CEST	12143	49745	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:18.024079084 CEST	49746	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:18.238363981 CEST	12143	49746	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:18.241494894 CEST	49746	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:18.244215012 CEST	49746	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:18.458199024 CEST	12143	49746	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:18.460494041 CEST	49746	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:18.677007914 CEST	12143	49746	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:18.677155018 CEST	49746	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:18.891343117 CEST	12143	49746	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:18.891474009 CEST	49746	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:18.899785042 CEST	12143	49746	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:18.899877071 CEST	49746	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:19.105509996 CEST	12143	49746	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:19.113770008 CEST	12143	49746	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:19.523883104 CEST	49747	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:19.739509106 CEST	12143	49747	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:19.745465994 CEST	49747	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:19.750801086 CEST	49747	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:19.967164993 CEST	12143	49747	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:19.967262030 CEST	49747	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:20.182816029 CEST	12143	49747	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:20.183672905 CEST	49747	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:20.399246931 CEST	12143	49747	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:20.399615049 CEST	49747	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:20.615185976 CEST	12143	49747	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:20.615315914 CEST	49747	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:20.773283005 CEST	12143	49747	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:20.773374081 CEST	49747	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:20.830950022 CEST	12143	49747	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:20.988886118 CEST	12143	49747	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:21.367124081 CEST	49748	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:21.582998037 CEST	12143	49748	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:21.583122969 CEST	49748	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:21.585946083 CEST	49748	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:21.801672935 CEST	12143	49748	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:21.801758051 CEST	49748	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:22.017625093 CEST	12143	49748	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:22.017771006 CEST	49748	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:22.233681917 CEST	12143	49748	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:22.233810902 CEST	49748	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:22.357264996 CEST	12143	49748	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:22.357355118 CEST	49748	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:22.449841976 CEST	12143	49748	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:22.573050976 CEST	12143	49748	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:22.898380041 CEST	49749	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:23.110311031 CEST	12143	49749	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:23.112992048 CEST	49749	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:23.116307974 CEST	49749	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:23.328161955 CEST	12143	49749	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:23.329437971 CEST	49749	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:23.541213989 CEST	12143	49749	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:23.541467905 CEST	49749	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:23.753293991 CEST	12143	49749	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:23.753410101 CEST	49749	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:23.824172974 CEST	12143	49749	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:23.824265003 CEST	49749	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:23.965364933 CEST	12143	49749	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:24.036412954 CEST	12143	49749	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:24.336452961 CEST	49750	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:24.550796032 CEST	12143	49750	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:24.550915003 CEST	49750	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:24.553736925 CEST	49750	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:24.765490055 CEST	12143	49750	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:24.766062021 CEST	49750	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:24.907007933 CEST	12143	49750	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:24.907082081 CEST	49750	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:24.979929924 CEST	12143	49750	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:25.118927002 CEST	12143	49750	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:25.382916927 CEST	49751	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:25.596364021 CEST	12143	49751	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:25.596458912 CEST	49751	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:25.599227905 CEST	49751	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:25.812427044 CEST	12143	49751	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:25.812582970 CEST	49751	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:25.991564035 CEST	12143	49751	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:25.991666079 CEST	49751	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:26.028002024 CEST	12143	49751	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:26.205014944 CEST	12143	49751	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:26.448940039 CEST	49752	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:26.662558079 CEST	12143	49752	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:26.662657976 CEST	49752	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:26.665270090 CEST	49752	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:26.878861904 CEST	12143	49752	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:26.879013062 CEST	49752	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:27.093377113 CEST	12143	49752	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:27.093514919 CEST	49752	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:27.307054996 CEST	12143	49752	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:27.307162046 CEST	49752	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:27.357857943 CEST	12143	49752	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:27.357932091 CEST	49752	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:27.520687103 CEST	12143	49752	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:27.571415901 CEST	12143	49752	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:27.773914099 CEST	49753	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:27.988149881 CEST	12143	49753	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:27.988317013 CEST	49753	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:27.991178989 CEST	49753	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:28.205265045 CEST	12143	49753	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:28.205358028 CEST	49753	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:28.420057058 CEST	12143	49753	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:28.420219898 CEST	49753	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:28.567104101 CEST	12143	49753	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:28.567183971 CEST	49753	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:28.634336948 CEST	12143	49753	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:28.781196117 CEST	12143	49753	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:28.960944891 CEST	49754	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:29.173593998 CEST	12143	49754	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:29.173712969 CEST	49754	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:29.176542997 CEST	49754	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:29.389102936 CEST	12143	49754	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:29.389230013 CEST	49754	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:29.601787090 CEST	12143	49754	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:29.601912022 CEST	49754	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:29.814579010 CEST	12143	49754	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:29.814769030 CEST	49754	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:29.927675962 CEST	12143	49754	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:29.927772999 CEST	49754	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:30.027261019 CEST	12143	49754	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:30.140286922 CEST	12143	49754	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:30.289408922 CEST	49755	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:30.506282091 CEST	12143	49755	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:30.506412983 CEST	49755	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:30.509063005 CEST	49755	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:30.725630045 CEST	12143	49755	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:30.725768089 CEST	49755	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:30.942513943 CEST	12143	49755	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:30.942693949 CEST	49755	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:30.945957899 CEST	12143	49755	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:30.946052074 CEST	49755	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:31.159867048 CEST	12143	49755	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:31.162514925 CEST	12143	49755	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:31.316888094 CEST	49756	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:31.530680895 CEST	12143	49756	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:31.530771017 CEST	49756	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:31.533274889 CEST	49756	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:31.747097015 CEST	12143	49756	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:31.747522116 CEST	49756	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:31.902204990 CEST	12143	49756	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:31.903476954 CEST	49756	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:31.961951971 CEST	12143	49756	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:32.117398024 CEST	12143	49756	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:33.484826088 CEST	49757	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:33.699316025 CEST	12143	49757	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:33.699502945 CEST	49757	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:33.702641964 CEST	49757	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:33.916922092 CEST	12143	49757	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:33.917088032 CEST	49757	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:34.075078964 CEST	12143	49757	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:34.075165033 CEST	49757	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:34.131428957 CEST	12143	49757	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:34.289448023 CEST	12143	49757	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:34.367199898 CEST	49758	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:34.579793930 CEST	12143	49758	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:34.579930067 CEST	49758	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:34.582566977 CEST	49758	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:34.795193911 CEST	12143	49758	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:34.795305967 CEST	49758	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:35.007929087 CEST	12143	49758	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:35.008148909 CEST	49758	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:35.220640898 CEST	12143	49758	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:35.220746994 CEST	49758	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:35.283354044 CEST	12143	49758	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:35.283425093 CEST	49758	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:35.433249950 CEST	12143	49758	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:35.495871067 CEST	12143	49758	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:35.573610067 CEST	49759	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:35.788170099 CEST	12143	49759	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:35.788273096 CEST	49759	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:35.790973902 CEST	49759	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:36.005341053 CEST	12143	49759	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:36.005501032 CEST	49759	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:36.219985008 CEST	12143	49759	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:36.220154047 CEST	49759	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:36.349551916 CEST	12143	49759	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:36.349663019 CEST	49759	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:36.434644938 CEST	12143	49759	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:36.564217091 CEST	12143	49759	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:36.619971991 CEST	49760	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:36.834384918 CEST	12143	49760	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:36.834585905 CEST	49760	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:36.837179899 CEST	49760	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:37.051367998 CEST	12143	49760	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:37.051475048 CEST	49760	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:37.265743971 CEST	12143	49760	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:37.265925884 CEST	49760	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:37.480199099 CEST	12143	49760	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:37.480364084 CEST	49760	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:37.516613007 CEST	12143	49760	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:37.516700983 CEST	49760	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:37.694631100 CEST	12143	49760	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:37.731499910 CEST	12143	49760	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:37.758080006 CEST	49761	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:37.971815109 CEST	12143	49761	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:37.972069025 CEST	49761	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:37.975112915 CEST	49761	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:38.188714027 CEST	12143	49761	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:38.188783884 CEST	49761	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:38.403338909 CEST	12143	49761	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:38.403484106 CEST	49761	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:38.617077112 CEST	12143	49761	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:38.619961977 CEST	49761	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:38.833630085 CEST	12143	49761	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:38.833719015 CEST	49761	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:38.869003057 CEST	12143	49761	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:38.869080067 CEST	49761	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:39.047346115 CEST	12143	49761	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:39.082685947 CEST	12143	49761	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:39.101697922 CEST	49762	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:39.317951918 CEST	12143	49762	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:39.321436882 CEST	49762	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:39.324160099 CEST	49762	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:39.540359974 CEST	12143	49762	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:39.540590048 CEST	49762	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:39.756815910 CEST	12143	49762	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:39.756968021 CEST	49762	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:39.973186016 CEST	12143	49762	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:39.973304033 CEST	49762	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:40.049618959 CEST	12143	49762	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:40.049748898 CEST	49762	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:40.189563990 CEST	12143	49762	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:40.257198095 CEST	49762	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:40.258579969 CEST	49763	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:40.266268015 CEST	12143	49762	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:40.474078894 CEST	12143	49763	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:40.474164963 CEST	49763	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:40.475177050 CEST	12143	49762	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:40.481182098 CEST	49763	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:40.694744110 CEST	12143	49763	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:40.694840908 CEST	49763	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:40.851485968 CEST	12143	49763	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:40.851581097 CEST	49763	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:40.908485889 CEST	12143	49763	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:41.053106070 CEST	49763	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:41.056375980 CEST	49764	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:41.065139055 CEST	12143	49763	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:41.266727924 CEST	12143	49763	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:41.271158934 CEST	12143	49764	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:41.271244049 CEST	49764	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:41.273956060 CEST	49764	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:41.490521908 CEST	12143	49764	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:41.490643024 CEST	49764	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:41.639519930 CEST	12143	49764	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:41.639677048 CEST	49764	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:41.705399036 CEST	12143	49764	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:41.834367990 CEST	49764	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:41.836065054 CEST	49765	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:41.854422092 CEST	12143	49764	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:42.048742056 CEST	12143	49765	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:42.048867941 CEST	49765	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:42.049765110 CEST	12143	49764	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:42.051762104 CEST	49765	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:42.265728951 CEST	12143	49765	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:42.265849113 CEST	49765	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:42.478457928 CEST	12143	49765	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:42.478549004 CEST	49765	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:42.693409920 CEST	12143	49765	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:42.693569899 CEST	49765	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:42.727929115 CEST	12143	49765	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:42.728028059 CEST	49765	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:42.897252083 CEST	49765	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:42.899378061 CEST	49766	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:42.908263922 CEST	12143	49765	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:42.941714048 CEST	12143	49765	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:43.109942913 CEST	12143	49765	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:43.112658978 CEST	12143	49766	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:43.112744093 CEST	49766	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:43.118587017 CEST	49766	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:43.332747936 CEST	12143	49766	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:43.332834005 CEST	49766	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:43.546835899 CEST	12143	49766	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:43.546948910 CEST	49766	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:43.760209084 CEST	12143	49766	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:43.760310888 CEST	49766	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:43.838278055 CEST	12143	49766	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:43.838366985 CEST	49766	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:43.973624945 CEST	12143	49766	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:44.008650064 CEST	49766	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:44.014697075 CEST	49767	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:44.051556110 CEST	12143	49766	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:44.222264051 CEST	12143	49766	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:44.231620073 CEST	12143	49767	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:44.231690884 CEST	49767	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:44.234536886 CEST	49767	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:44.452224970 CEST	12143	49767	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:44.452346087 CEST	49767	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:44.668253899 CEST	12143	49767	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:44.668370008 CEST	49767	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:44.884341002 CEST	12143	49767	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:44.884432077 CEST	49767	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:44.939188957 CEST	12143	49767	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:44.939264059 CEST	49767	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:45.100279093 CEST	12143	49767	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:45.100658894 CEST	49767	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:45.111176014 CEST	49768	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:45.155117035 CEST	12143	49767	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:45.316598892 CEST	12143	49767	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:45.326488018 CEST	12143	49768	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:45.326579094 CEST	49768	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:45.332772970 CEST	49768	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:45.548166037 CEST	12143	49768	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:45.548228025 CEST	49768	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:45.696006060 CEST	12143	49768	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:45.696075916 CEST	49768	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:45.763576984 CEST	12143	49768	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:45.834405899 CEST	49768	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:45.836533070 CEST	49769	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:45.911623955 CEST	12143	49768	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.049832106 CEST	12143	49768	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.050297976 CEST	12143	49769	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.050374985 CEST	49769	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:46.053330898 CEST	49769	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:46.266906977 CEST	12143	49769	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.267043114 CEST	49769	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:46.480622053 CEST	12143	49769	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.480741024 CEST	49769	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:46.634598970 CEST	12143	49769	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.637449980 CEST	49769	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:46.694314003 CEST	12143	49769	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.771893978 CEST	49769	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:46.773356915 CEST	49770	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:46.851094961 CEST	12143	49769	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.985528946 CEST	12143	49769	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.986625910 CEST	12143	49770	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:46.986710072 CEST	49770	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:46.989329100 CEST	49770	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:47.202545881 CEST	12143	49770	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:47.203506947 CEST	49770	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:47.417035103 CEST	12143	49770	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:47.419527054 CEST	49770	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:47.569578886 CEST	12143	49770	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:47.571491957 CEST	49770	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:47.632993937 CEST	12143	49770	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:47.693897009 CEST	49770	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:47.695373058 CEST	49771	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:47.784746885 CEST	12143	49770	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:47.907139063 CEST	12143	49770	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:47.911151886 CEST	12143	49771	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:47.911252022 CEST	49771	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:47.914115906 CEST	49771	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:48.129879951 CEST	12143	49771	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:48.129955053 CEST	49771	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:48.345765114 CEST	12143	49771	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:48.345855951 CEST	49771	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:48.561836958 CEST	12143	49771	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:48.561934948 CEST	49771	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:48.620160103 CEST	12143	49771	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:48.620229006 CEST	49771	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:48.740557909 CEST	49771	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:48.741863966 CEST	49772	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:48.777755022 CEST	12143	49771	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:48.836570024 CEST	12143	49771	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:48.965960979 CEST	12143	49771	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:48.966991901 CEST	12143	49772	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:48.967097044 CEST	49772	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:48.969739914 CEST	49772	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:49.185616016 CEST	12143	49772	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:49.188492060 CEST	49772	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:49.404611111 CEST	12143	49772	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:49.407392979 CEST	49772	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:49.623583078 CEST	12143	49772	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:49.627002001 CEST	49772	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:49.807343960 CEST	12143	49772	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:49.807497025 CEST	49772	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:49.842623949 CEST	12143	49772	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:50.023313999 CEST	12143	49772	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:51.382905006 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:51.598758936 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:51.598937035 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:51.602741957 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:51.818186045 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:51.818325043 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:52.036163092 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:52.036297083 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:52.251713037 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:52.251764059 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:52.468266010 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:52.468386889 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:52.638720989 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:52.639472961 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:52.684045076 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:52.740983963 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:52.742443085 CEST	49774	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:52.849890947 CEST	49773	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:52.856318951 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:52.957463980 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:52.958116055 CEST	12143	49774	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:52.958255053 CEST	49774	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:52.961389065 CEST	49774	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:53.066292048 CEST	12143	49773	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:53.175827026 CEST	12143	49774	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:53.177417994 CEST	49774	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:53.392040014 CEST	12143	49774	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:53.395668030 CEST	49774	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:53.477875948 CEST	12143	49774	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:53.479738951 CEST	49774	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:53.584579945 CEST	49774	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:53.586572886 CEST	49775	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:53.610145092 CEST	12143	49774	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:53.694314957 CEST	12143	49774	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:53.800153017 CEST	12143	49774	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:53.802716017 CEST	12143	49775	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:53.802839041 CEST	49775	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:53.810807943 CEST	49775	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:54.026263952 CEST	12143	49775	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:54.026421070 CEST	49775	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:54.241872072 CEST	12143	49775	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:54.242022038 CEST	49775	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:54.457472086 CEST	12143	49775	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:54.457573891 CEST	49775	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:54.673060894 CEST	12143	49775	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:54.673238039 CEST	49775	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:54.835391998 CEST	12143	49775	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:54.835488081 CEST	49775	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:54.888777971 CEST	12143	49775	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:54.929224014 CEST	49775	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:54.930706978 CEST	49776	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:55.051002979 CEST	12143	49775	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:55.145035028 CEST	12143	49775	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:55.145066977 CEST	12143	49776	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:55.145230055 CEST	49776	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:55.152571917 CEST	49776	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:55.366853952 CEST	12143	49776	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:55.366935968 CEST	49776	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:55.521822929 CEST	12143	49776	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:55.521965027 CEST	49776	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:55.580984116 CEST	12143	49776	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:55.624037027 CEST	49776	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:55.637130022 CEST	49777	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:55.738451004 CEST	12143	49776	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:55.838341951 CEST	12143	49776	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:55.853219986 CEST	12143	49777	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:55.853351116 CEST	49777	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:55.856296062 CEST	49777	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:56.071876049 CEST	12143	49777	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:56.071957111 CEST	49777	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:56.287570953 CEST	12143	49777	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:56.287669897 CEST	49777	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:56.327050924 CEST	12143	49777	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:56.327111959 CEST	49777	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:56.412798882 CEST	49777	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:56.414344072 CEST	49778	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:56.503216982 CEST	12143	49777	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:56.542620897 CEST	12143	49777	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:56.627955914 CEST	12143	49778	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:56.628120899 CEST	49778	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:56.628206015 CEST	12143	49777	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:56.630894899 CEST	49778	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:56.845138073 CEST	12143	49778	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:56.845268011 CEST	49778	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:57.058990955 CEST	12143	49778	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:57.059663057 CEST	49778	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:57.273407936 CEST	12143	49778	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:57.276246071 CEST	49778	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:57.459316015 CEST	12143	49778	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:57.461452961 CEST	49778	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:57.489944935 CEST	12143	49778	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:57.538120031 CEST	49778	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:57.539911985 CEST	49779	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:57.675108910 CEST	12143	49778	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:57.751744986 CEST	12143	49778	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:57.755199909 CEST	12143	49779	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:57.755300045 CEST	49779	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:57.758028984 CEST	49779	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:57.973346949 CEST	12143	49779	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:57.973480940 CEST	49779	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:58.188913107 CEST	12143	49779	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:58.189002991 CEST	49779	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:58.359766960 CEST	12143	49779	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:58.359996080 CEST	49779	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:58.405061007 CEST	12143	49779	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:58.428158045 CEST	49779	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:58.545295954 CEST	49780	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:58.579279900 CEST	12143	49779	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:58.643578053 CEST	12143	49779	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:58.758227110 CEST	12143	49780	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:58.758306026 CEST	49780	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:58.764149904 CEST	49780	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:58.977118015 CEST	12143	49780	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:58.977189064 CEST	49780	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:59.190172911 CEST	12143	49780	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:59.190325022 CEST	49780	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:59.403441906 CEST	12143	49780	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:59.403589010 CEST	49780	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:59.616594076 CEST	12143	49780	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:59.616744995 CEST	49780	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:59.798306942 CEST	12143	49780	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:59.799772978 CEST	49780	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:59.829772949 CEST	12143	49780	3.125.102.39	192.168.2.5
Apr 25, 2024 00:48:59.865750074 CEST	49780	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:48:59.867563963 CEST	49781	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:00.012742043 CEST	12143	49780	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.078784943 CEST	12143	49780	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.081409931 CEST	12143	49781	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.085458994 CEST	49781	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:00.088012934 CEST	49781	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:00.302007914 CEST	12143	49781	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.305479050 CEST	49781	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:00.519506931 CEST	12143	49781	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.521169901 CEST	49781	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:00.533499002 CEST	12143	49781	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.535406113 CEST	49781	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:00.599922895 CEST	49781	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:00.601941109 CEST	49782	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:00.736032009 CEST	12143	49781	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.750485897 CEST	12143	49781	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.814069033 CEST	12143	49781	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.816112041 CEST	12143	49782	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:00.816211939 CEST	49782	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:00.819506884 CEST	49782	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:01.033920050 CEST	12143	49782	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:01.034040928 CEST	49782	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:01.248368025 CEST	12143	49782	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:01.248502016 CEST	49782	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:01.389731884 CEST	12143	49782	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:01.389820099 CEST	49782	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:01.443866968 CEST	49782	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:01.445198059 CEST	49783	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:01.464484930 CEST	12143	49782	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:01.604775906 CEST	12143	49782	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:01.659298897 CEST	12143	49782	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:01.662014008 CEST	12143	49783	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:01.665457010 CEST	49783	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:01.668226957 CEST	49783	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:01.884356976 CEST	12143	49783	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:01.885479927 CEST	49783	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:02.102360010 CEST	12143	49783	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:02.102474928 CEST	49783	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:02.318147898 CEST	12143	49783	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:02.319648981 CEST	49783	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:02.535413980 CEST	12143	49783	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:02.535613060 CEST	49783	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:02.675427914 CEST	12143	49783	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:02.675570965 CEST	49783	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:02.725444078 CEST	49783	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:02.730585098 CEST	49784	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:02.751301050 CEST	12143	49783	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:02.891390085 CEST	12143	49783	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:02.942233086 CEST	12143	49783	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:02.944459915 CEST	12143	49784	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:02.944621086 CEST	49784	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:02.947237968 CEST	49784	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:03.161191940 CEST	12143	49784	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:03.161317110 CEST	49784	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:03.375247002 CEST	12143	49784	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:03.375417948 CEST	49784	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:03.590183020 CEST	12143	49784	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:03.590399981 CEST	49784	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:03.655220032 CEST	12143	49784	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:03.655385971 CEST	49784	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:03.709537983 CEST	49784	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:03.711256981 CEST	49785	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:03.804457903 CEST	12143	49784	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:03.869647026 CEST	12143	49784	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:03.923705101 CEST	12143	49784	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:03.925945044 CEST	12143	49785	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:03.926042080 CEST	49785	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:03.929745913 CEST	49785	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:04.144470930 CEST	12143	49785	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:04.144543886 CEST	49785	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:04.359067917 CEST	12143	49785	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:04.359224081 CEST	49785	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:04.573992968 CEST	12143	49785	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:04.574095964 CEST	49785	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:04.634042978 CEST	12143	49785	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:04.634130001 CEST	49785	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:04.678134918 CEST	49785	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:04.679889917 CEST	49786	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:04.788743019 CEST	12143	49785	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:04.848825932 CEST	12143	49785	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:04.892666101 CEST	12143	49785	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:04.894747972 CEST	12143	49786	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:04.897444010 CEST	49786	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:04.900337934 CEST	49786	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:05.115166903 CEST	12143	49786	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:05.117480993 CEST	49786	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:05.332551003 CEST	12143	49786	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:05.333447933 CEST	49786	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:05.363559008 CEST	12143	49786	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:05.365466118 CEST	49786	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:05.414057970 CEST	49786	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:05.415414095 CEST	49787	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:05.548408031 CEST	12143	49786	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:05.580533028 CEST	12143	49786	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:05.628963947 CEST	12143	49786	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:05.629086018 CEST	12143	49787	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:05.629271030 CEST	49787	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:05.632261992 CEST	49787	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:05.846065998 CEST	12143	49787	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:05.846152067 CEST	49787	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:06.060059071 CEST	12143	49787	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:06.060262918 CEST	49787	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:06.274245977 CEST	12143	49787	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:06.274399996 CEST	49787	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:06.488370895 CEST	12143	49787	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:06.488485098 CEST	49787	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:06.575640917 CEST	12143	49787	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:06.575717926 CEST	49787	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:06.615580082 CEST	49787	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:06.616918087 CEST	49788	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:06.702354908 CEST	12143	49787	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:06.790007114 CEST	12143	49787	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:06.829344034 CEST	12143	49787	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:06.830799103 CEST	12143	49788	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:06.830933094 CEST	49788	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:07.008677006 CEST	49788	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:07.225300074 CEST	12143	49788	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:07.225395918 CEST	49788	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:07.439707994 CEST	12143	49788	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:07.439855099 CEST	49788	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:07.501226902 CEST	12143	49788	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:07.501408100 CEST	49788	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:07.684042931 CEST	12143	49788	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:07.756370068 CEST	12143	49788	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:08.529966116 CEST	49789	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:08.744954109 CEST	12143	49789	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:08.745090961 CEST	49789	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:08.747792959 CEST	49789	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:08.962704897 CEST	12143	49789	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:08.962858915 CEST	49789	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:09.147844076 CEST	12143	49789	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:09.147948980 CEST	49789	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:09.178090096 CEST	12143	49789	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:09.194932938 CEST	49789	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:09.196552038 CEST	49790	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:09.362899065 CEST	12143	49789	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:09.409924030 CEST	12143	49789	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:09.412652969 CEST	12143	49790	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:09.412796021 CEST	49790	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:09.415690899 CEST	49790	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:09.631853104 CEST	12143	49790	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:09.631966114 CEST	49790	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:09.848097086 CEST	12143	49790	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:09.848304033 CEST	49790	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:10.043597937 CEST	12143	49790	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:10.043720007 CEST	49790	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:10.064450979 CEST	12143	49790	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:10.084381104 CEST	49790	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:10.086175919 CEST	49791	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:10.259932041 CEST	12143	49790	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:10.300595045 CEST	12143	49790	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:10.300627947 CEST	12143	49791	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:10.300724983 CEST	49791	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:10.303679943 CEST	49791	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:10.518187046 CEST	12143	49791	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:10.518340111 CEST	49791	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:10.732784986 CEST	12143	49791	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:10.732891083 CEST	49791	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:10.948980093 CEST	12143	49791	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:10.949053049 CEST	49791	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:11.163404942 CEST	12143	49791	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:11.163542986 CEST	49791	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:11.334572077 CEST	12143	49791	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:11.334650040 CEST	49791	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:11.366875887 CEST	49791	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:11.368237019 CEST	49792	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:11.377898932 CEST	12143	49791	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:11.548923969 CEST	12143	49791	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:11.581387997 CEST	12143	49791	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:11.583110094 CEST	12143	49792	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:11.583185911 CEST	49792	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:11.586071968 CEST	49792	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:11.801292896 CEST	12143	49792	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:11.801460028 CEST	49792	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:12.016427994 CEST	12143	49792	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:12.017448902 CEST	49792	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:12.232374907 CEST	12143	49792	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:12.232508898 CEST	49792	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:12.339924097 CEST	12143	49792	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:12.341475964 CEST	49792	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:12.381302118 CEST	49792	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:12.382788897 CEST	49793	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:12.447531939 CEST	12143	49792	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:12.556341887 CEST	12143	49792	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:12.596296072 CEST	12143	49792	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:12.598052025 CEST	12143	49793	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:12.601449013 CEST	49793	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:12.605212927 CEST	49793	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:12.820487022 CEST	12143	49793	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:12.820590019 CEST	49793	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:13.022109985 CEST	12143	49793	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:13.022229910 CEST	49793	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:13.035953999 CEST	12143	49793	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:13.053062916 CEST	49793	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:13.054485083 CEST	49794	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:13.237445116 CEST	12143	49793	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:13.268445015 CEST	12143	49793	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:13.268461943 CEST	12143	49794	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:13.268621922 CEST	49794	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:13.273148060 CEST	49794	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:13.487150908 CEST	12143	49794	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:13.487235069 CEST	49794	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:13.701355934 CEST	12143	49794	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:13.703716993 CEST	49794	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:13.918066978 CEST	12143	49794	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:13.919878006 CEST	49794	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.023312092 CEST	12143	49794	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:14.023933887 CEST	49794	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.053075075 CEST	49794	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.054636002 CEST	49795	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.133866072 CEST	12143	49794	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:14.237881899 CEST	12143	49794	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:14.267038107 CEST	12143	49794	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:14.270605087 CEST	12143	49795	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:14.270704985 CEST	49795	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.273814917 CEST	49795	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.489855051 CEST	12143	49795	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:14.492455006 CEST	49795	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.708601952 CEST	12143	49795	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:14.708767891 CEST	49795	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.782150984 CEST	12143	49795	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:14.782264948 CEST	49795	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.818660021 CEST	49795	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.820067883 CEST	49796	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:14.924896002 CEST	12143	49795	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:14.998486996 CEST	12143	49795	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:15.034810066 CEST	12143	49795	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:15.035552025 CEST	12143	49796	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:15.035687923 CEST	49796	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:15.038634062 CEST	49796	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:15.254283905 CEST	12143	49796	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:15.254451036 CEST	49796	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:15.470105886 CEST	12143	49796	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:15.470218897 CEST	49796	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:15.685812950 CEST	12143	49796	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:15.685909986 CEST	49796	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:15.901572943 CEST	12143	49796	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:15.901724100 CEST	49796	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:16.078695059 CEST	12143	49796	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:16.078804016 CEST	49796	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:16.099908113 CEST	49796	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:16.101224899 CEST	49797	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:16.117301941 CEST	12143	49796	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:16.294380903 CEST	12143	49796	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:16.315485954 CEST	12143	49796	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:16.316874981 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:16.316991091 CEST	49797	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:16.319864988 CEST	49797	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:16.534540892 CEST	49797	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:16.535617113 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:16.750523090 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:16.750587940 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:16.750669956 CEST	49797	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:16.966521978 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:16.966659069 CEST	49797	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:17.182394028 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:17.182482004 CEST	49797	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:17.315850019 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:17.315985918 CEST	49797	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:17.334361076 CEST	49797	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:17.335731983 CEST	49798	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:17.398303032 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:17.531996012 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:17.550040960 CEST	12143	49797	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:17.550224066 CEST	12143	49798	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:17.550328970 CEST	49798	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:17.553292990 CEST	49798	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:17.767992973 CEST	12143	49798	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:17.768086910 CEST	49798	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:17.982785940 CEST	12143	49798	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:17.982872009 CEST	49798	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.197436094 CEST	12143	49798	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:18.197581053 CEST	49798	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.248347044 CEST	12143	49798	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:18.248471975 CEST	49798	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.272444010 CEST	49798	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.278799057 CEST	49799	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.412158966 CEST	12143	49798	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:18.463284969 CEST	12143	49798	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:18.487225056 CEST	12143	49798	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:18.494370937 CEST	12143	49799	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:18.494473934 CEST	49799	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.496968985 CEST	49799	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.712645054 CEST	12143	49799	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:18.713450909 CEST	49799	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.930197001 CEST	12143	49799	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:18.930326939 CEST	49799	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.969144106 CEST	12143	49799	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:18.969234943 CEST	49799	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.990700960 CEST	49799	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:18.994549990 CEST	49800	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:19.146188021 CEST	12143	49799	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:19.184868097 CEST	12143	49799	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:19.206847906 CEST	12143	49799	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:19.208895922 CEST	12143	49800	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:19.211529016 CEST	49800	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:19.216442108 CEST	49800	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:19.430742025 CEST	12143	49800	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:19.431498051 CEST	49800	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:19.646317005 CEST	12143	49800	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:19.646492958 CEST	49800	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:19.838871956 CEST	12143	49800	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:19.838987112 CEST	49800	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:19.860542059 CEST	12143	49800	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:19.865581989 CEST	49800	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:19.866970062 CEST	49801	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:20.053101063 CEST	12143	49800	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.079701900 CEST	12143	49800	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.082145929 CEST	12143	49801	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.082278967 CEST	49801	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:20.085427046 CEST	49801	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:20.300643921 CEST	12143	49801	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.300717115 CEST	49801	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:20.452311993 CEST	12143	49801	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.452480078 CEST	49801	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:20.474947929 CEST	49801	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:20.476742029 CEST	49802	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:20.516000032 CEST	12143	49801	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.667833090 CEST	12143	49801	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.690223932 CEST	12143	49801	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.691303015 CEST	12143	49802	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.691385031 CEST	49802	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:20.694989920 CEST	49802	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:20.910016060 CEST	12143	49802	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:20.910124063 CEST	49802	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:21.126328945 CEST	12143	49802	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:21.126509905 CEST	49802	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:21.244492054 CEST	12143	49802	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:21.245333910 CEST	49802	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:21.271785021 CEST	49802	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:21.273581982 CEST	49803	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:21.341161013 CEST	12143	49802	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:21.459922075 CEST	12143	49802	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:21.486390114 CEST	12143	49802	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:21.488619089 CEST	12143	49803	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:21.488759041 CEST	49803	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:21.492913961 CEST	49803	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:21.707977057 CEST	12143	49803	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:21.708123922 CEST	49803	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:21.923280954 CEST	12143	49803	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:21.923464060 CEST	49803	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:22.120874882 CEST	12143	49803	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:22.121026993 CEST	49803	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:22.138535023 CEST	12143	49803	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:22.146852016 CEST	49803	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:22.148714066 CEST	49804	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:22.336282015 CEST	12143	49803	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:22.362108946 CEST	12143	49803	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:22.364335060 CEST	12143	49804	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:22.364430904 CEST	49804	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:22.367151976 CEST	49804	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:22.582789898 CEST	12143	49804	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:22.582931995 CEST	49804	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:22.798521996 CEST	12143	49804	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:22.798671961 CEST	49804	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.014744043 CEST	12143	49804	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:23.014841080 CEST	49804	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.075397015 CEST	12143	49804	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:23.075525045 CEST	49804	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.100224972 CEST	49804	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.103008986 CEST	49805	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.230448008 CEST	12143	49804	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:23.293986082 CEST	12143	49804	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:23.315869093 CEST	12143	49804	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:23.317135096 CEST	12143	49805	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:23.317220926 CEST	49805	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.328511953 CEST	49805	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.542551041 CEST	12143	49805	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:23.542679071 CEST	49805	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.761293888 CEST	12143	49805	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:23.764199972 CEST	49805	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.857980967 CEST	12143	49805	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:23.859420061 CEST	49805	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.881692886 CEST	49805	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.883112907 CEST	49806	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:23.978383064 CEST	12143	49805	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.073487997 CEST	12143	49805	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.095356941 CEST	12143	49806	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.095923901 CEST	12143	49805	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.096057892 CEST	49806	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:24.126807928 CEST	49806	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:24.339464903 CEST	12143	49806	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.343698978 CEST	49806	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:24.492881060 CEST	12143	49806	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.495646954 CEST	49806	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:24.523020029 CEST	49806	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:24.524637938 CEST	49807	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:24.555897951 CEST	12143	49806	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.708318949 CEST	12143	49806	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.735219002 CEST	12143	49806	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.741832972 CEST	12143	49807	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.741928101 CEST	49807	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:24.764519930 CEST	49807	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:24.980376005 CEST	12143	49807	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:24.980519056 CEST	49807	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:25.145637035 CEST	12143	49807	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:25.145725012 CEST	49807	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:25.196228981 CEST	12143	49807	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:25.363075972 CEST	12143	49807	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:25.998393059 CEST	49808	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:26.214602947 CEST	12143	49808	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:26.214760065 CEST	49808	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:26.217596054 CEST	49808	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:26.433490038 CEST	12143	49808	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:26.433619976 CEST	49808	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:26.649593115 CEST	12143	49808	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:26.649701118 CEST	49808	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:26.866322041 CEST	12143	49808	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:26.866465092 CEST	49808	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:26.926578045 CEST	12143	49808	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:26.926662922 CEST	49808	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:26.944027901 CEST	49808	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:26.945581913 CEST	49809	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:27.083452940 CEST	12143	49808	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.142591953 CEST	12143	49808	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.159658909 CEST	12143	49809	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.159751892 CEST	49809	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:27.159856081 CEST	12143	49808	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.162480116 CEST	49809	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:27.376413107 CEST	12143	49809	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.376660109 CEST	49809	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:27.539470911 CEST	12143	49809	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.539601088 CEST	49809	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:27.553189993 CEST	49809	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:27.554858923 CEST	49810	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:27.590739965 CEST	12143	49809	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.753645897 CEST	12143	49809	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.767354965 CEST	12143	49809	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.769618988 CEST	12143	49810	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.769699097 CEST	49810	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:27.772718906 CEST	49810	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:27.987422943 CEST	12143	49810	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:27.987572908 CEST	49810	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.141765118 CEST	12143	49810	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:28.141866922 CEST	49810	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.162403107 CEST	49810	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.164392948 CEST	49811	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.202399015 CEST	12143	49810	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:28.356559038 CEST	12143	49810	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:28.377054930 CEST	12143	49810	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:28.378038883 CEST	12143	49811	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:28.378113985 CEST	49811	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.381325006 CEST	49811	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.595197916 CEST	12143	49811	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:28.595308065 CEST	49811	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.809015989 CEST	12143	49811	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:28.809149981 CEST	49811	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.879684925 CEST	12143	49811	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:28.879851103 CEST	49811	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.896775007 CEST	49811	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:28.898233891 CEST	49812	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.023015976 CEST	12143	49811	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.096483946 CEST	12143	49811	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.110570908 CEST	12143	49811	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.111376047 CEST	12143	49812	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.111529112 CEST	49812	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.114643097 CEST	49812	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.328043938 CEST	12143	49812	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.328157902 CEST	49812	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.541423082 CEST	12143	49812	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.541493893 CEST	49812	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.543245077 CEST	12143	49812	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.543293953 CEST	49812	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.552974939 CEST	49812	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.554791927 CEST	49813	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.754595041 CEST	12143	49812	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.756258011 CEST	12143	49812	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.765955925 CEST	12143	49812	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.768568993 CEST	12143	49813	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.768727064 CEST	49813	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.771872997 CEST	49813	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:29.985606909 CEST	12143	49813	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:29.987742901 CEST	49813	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:30.201664925 CEST	12143	49813	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:30.201900005 CEST	49813	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:30.415743113 CEST	12143	49813	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:30.421484947 CEST	49813	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:30.635382891 CEST	12143	49813	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:30.635560036 CEST	49813	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:30.816457987 CEST	12143	49813	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:30.816620111 CEST	49813	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:30.834319115 CEST	49813	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:30.835746050 CEST	49814	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:30.850613117 CEST	12143	49813	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.030543089 CEST	12143	49813	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.048295975 CEST	12143	49813	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.049375057 CEST	12143	49814	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.049513102 CEST	49814	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:31.052670956 CEST	49814	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:31.266463041 CEST	12143	49814	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.266597033 CEST	49814	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:31.480294943 CEST	12143	49814	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.480374098 CEST	49814	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:31.496318102 CEST	12143	49814	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.496572018 CEST	49814	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:31.506232977 CEST	49814	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:31.507992983 CEST	49815	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:31.693924904 CEST	12143	49814	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.710311890 CEST	12143	49814	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.721693039 CEST	12143	49814	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.725364923 CEST	12143	49815	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.725461006 CEST	49815	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:31.730194092 CEST	49815	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:31.946185112 CEST	12143	49815	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:31.946274042 CEST	49815	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:32.116771936 CEST	12143	49815	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:32.116846085 CEST	49815	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:32.131074905 CEST	49815	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:32.132436037 CEST	49816	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:32.162369967 CEST	12143	49815	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:32.332515955 CEST	12143	49815	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:32.346685886 CEST	12143	49815	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:32.348145008 CEST	12143	49816	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:32.348259926 CEST	49816	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:32.351208925 CEST	49816	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:32.566930056 CEST	12143	49816	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:32.567050934 CEST	49816	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:32.784394979 CEST	12143	49816	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:32.784481049 CEST	49816	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:33.000626087 CEST	12143	49816	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:33.000782013 CEST	49816	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:33.216603041 CEST	12143	49816	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:33.216722012 CEST	49816	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:33.387478113 CEST	12143	49816	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:33.387545109 CEST	49816	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:33.396961927 CEST	49816	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:33.398355961 CEST	49817	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:33.432568073 CEST	12143	49816	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:33.603368998 CEST	12143	49816	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:33.612361908 CEST	12143	49817	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:33.612484932 CEST	49817	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:33.612734079 CEST	12143	49816	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:33.616044044 CEST	49817	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:33.830190897 CEST	12143	49817	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:33.830327034 CEST	49817	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:34.044367075 CEST	12143	49817	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:34.044642925 CEST	49817	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:34.147989988 CEST	12143	49817	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:34.148063898 CEST	49817	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:34.162344933 CEST	49817	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:34.166691065 CEST	49818	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:34.258665085 CEST	12143	49817	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:34.362179995 CEST	12143	49817	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:34.376369953 CEST	12143	49817	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:34.380223036 CEST	12143	49818	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:34.380340099 CEST	49818	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:34.383362055 CEST	49818	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:34.596688032 CEST	12143	49818	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:34.596765995 CEST	49818	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:34.810070992 CEST	12143	49818	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:34.811455011 CEST	49818	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:35.024813890 CEST	12143	49818	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:35.027673960 CEST	49818	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:35.241008997 CEST	12143	49818	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:35.241134882 CEST	49818	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:35.412300110 CEST	12143	49818	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:35.415724039 CEST	49818	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:35.428021908 CEST	49818	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:35.429493904 CEST	49819	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:35.454658985 CEST	12143	49818	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:35.629054070 CEST	12143	49818	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:35.641247988 CEST	12143	49818	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:35.645421982 CEST	12143	49819	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:35.649437904 CEST	49819	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:35.652450085 CEST	49819	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:35.868648052 CEST	12143	49819	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:35.868768930 CEST	49819	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:36.084760904 CEST	12143	49819	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:36.084913015 CEST	49819	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:36.214070082 CEST	12143	49819	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:36.214169979 CEST	49819	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:36.224875927 CEST	49819	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:36.226764917 CEST	49820	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:36.300846100 CEST	12143	49819	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:36.430236101 CEST	12143	49819	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:36.441309929 CEST	12143	49819	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:36.442086935 CEST	12143	49820	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:36.442193031 CEST	49820	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:36.448487997 CEST	49820	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:36.663866043 CEST	12143	49820	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:36.663945913 CEST	49820	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:36.880269051 CEST	12143	49820	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:36.880389929 CEST	49820	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:37.095808029 CEST	12143	49820	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:37.095885992 CEST	49820	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:37.109004974 CEST	12143	49820	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:37.109067917 CEST	49820	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:37.115508080 CEST	49820	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:37.117525101 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:37.311218023 CEST	12143	49820	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:37.324740887 CEST	12143	49820	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:37.330797911 CEST	12143	49820	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:37.331489086 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:37.331583977 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:37.335616112 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:37.549391985 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:37.549531937 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:37.763492107 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:37.763588905 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:37.977504015 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:37.977638006 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:38.191543102 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:38.191700935 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:38.362646103 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:38.362766981 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:38.381114960 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:38.382513046 CEST	49822	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:38.405565023 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:38.552933931 CEST	49821	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:38.577687025 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:38.596127987 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:38.597604990 CEST	12143	49822	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:38.597769022 CEST	49822	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:38.614370108 CEST	49822	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:38.766906977 CEST	12143	49821	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:38.828196049 CEST	12143	49822	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:38.828296900 CEST	49822	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.033401966 CEST	12143	49822	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:39.033706903 CEST	49822	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.037374020 CEST	49822	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.039151907 CEST	49823	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.042207003 CEST	12143	49822	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:39.247730970 CEST	12143	49822	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:39.251177073 CEST	12143	49822	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:39.252952099 CEST	12143	49823	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:39.253077030 CEST	49823	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.258467913 CEST	49823	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.472243071 CEST	12143	49823	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:39.472335100 CEST	49823	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.687349081 CEST	12143	49823	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:39.687524080 CEST	49823	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.901448011 CEST	12143	49823	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:39.904508114 CEST	49823	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.971043110 CEST	12143	49823	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:39.973428965 CEST	49823	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.990510941 CEST	49823	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:39.992187977 CEST	49824	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:40.118470907 CEST	12143	49823	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:40.187330008 CEST	12143	49823	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:40.204381943 CEST	12143	49823	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:40.207161903 CEST	12143	49824	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:40.207398891 CEST	49824	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:40.210388899 CEST	49824	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:40.425389051 CEST	12143	49824	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:40.427505016 CEST	49824	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:40.643264055 CEST	12143	49824	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:40.643409014 CEST	49824	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:40.858547926 CEST	12143	49824	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:40.858707905 CEST	49824	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:41.073693991 CEST	12143	49824	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:41.073776007 CEST	49824	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:41.114898920 CEST	12143	49824	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:41.114964008 CEST	49824	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:41.148586988 CEST	49824	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:41.149996042 CEST	49825	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:41.289055109 CEST	12143	49824	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:41.329957008 CEST	12143	49824	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:41.363528013 CEST	12143	49824	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:41.366147995 CEST	12143	49825	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:41.366247892 CEST	49825	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:41.373666048 CEST	49825	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:41.589235067 CEST	12143	49825	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:41.589318037 CEST	49825	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:41.804925919 CEST	12143	49825	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:41.804976940 CEST	49825	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:42.020689011 CEST	12143	49825	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:42.055047989 CEST	49825	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:42.069145918 CEST	12143	49825	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:42.069303989 CEST	49825	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:42.084249973 CEST	49825	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:42.085596085 CEST	49826	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:42.270817041 CEST	12143	49825	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:42.284826994 CEST	12143	49825	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:42.299750090 CEST	12143	49826	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:42.299870014 CEST	49826	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:42.300504923 CEST	12143	49825	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:43.536036968 CEST	49826	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:43.749125957 CEST	12143	49826	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:43.749274969 CEST	49826	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:43.962481976 CEST	12143	49826	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:43.962568045 CEST	49826	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:43.974504948 CEST	12143	49826	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:43.974574089 CEST	49826	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:43.990464926 CEST	49826	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:43.991956949 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:44.175688028 CEST	12143	49826	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:44.187540054 CEST	12143	49826	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:44.203331947 CEST	12143	49826	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:44.206168890 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:44.206258059 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:44.211236000 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:44.425569057 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:44.425673008 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:44.640549898 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:44.640677929 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:44.855995893 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:44.856122017 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:45.070489883 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:45.070597887 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:45.274838924 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:45.274971008 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:45.284867048 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:45.287358999 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:45.289884090 CEST	49828	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:45.459142923 CEST	49827	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:45.489239931 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:45.501565933 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:45.504858017 CEST	12143	49828	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:45.504965067 CEST	49828	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:45.509057999 CEST	49828	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:45.674777985 CEST	12143	49827	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:45.724163055 CEST	12143	49828	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:45.724278927 CEST	49828	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:45.941654921 CEST	12143	49828	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:45.941809893 CEST	49828	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:46.087768078 CEST	12143	49828	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:46.087869883 CEST	49828	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:46.099899054 CEST	49828	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:46.101299047 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:46.157308102 CEST	12143	49828	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:46.302911043 CEST	12143	49828	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:46.315437078 CEST	12143	49828	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:46.316030979 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:46.316117048 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:46.323694944 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:46.538628101 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:46.538707018 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:46.753891945 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:46.757453918 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:46.972238064 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:46.973433971 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:47.188246965 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:47.188361883 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:47.345046997 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:47.345122099 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:47.349903107 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:47.351965904 CEST	49830	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:47.403098106 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:47.552951097 CEST	49829	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:47.560900927 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:47.564806938 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:47.566864967 CEST	12143	49830	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:47.569392920 CEST	49830	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:47.572745085 CEST	49830	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:47.767775059 CEST	12143	49829	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:47.787224054 CEST	12143	49830	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:47.787360907 CEST	49830	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:48.004862070 CEST	12143	49830	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:48.004990101 CEST	49830	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:48.219520092 CEST	12143	49830	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:48.219700098 CEST	49830	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:48.315721989 CEST	12143	49830	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:48.315828085 CEST	49830	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:48.318567038 CEST	49830	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:48.320373058 CEST	49831	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:48.434386015 CEST	12143	49830	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:48.530332088 CEST	12143	49830	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:48.532974958 CEST	12143	49830	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:48.536876917 CEST	12143	49831	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:48.536967039 CEST	49831	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:48.539897919 CEST	49831	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:48.756314993 CEST	12143	49831	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:48.756385088 CEST	49831	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:48.972861052 CEST	12143	49831	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:48.972995996 CEST	49831	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:49.189564943 CEST	12143	49831	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:49.189805984 CEST	49831	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:49.277350903 CEST	12143	49831	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:49.277456045 CEST	49831	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:49.287559986 CEST	49831	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:49.289557934 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:49.406264067 CEST	12143	49831	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:49.493834019 CEST	12143	49831	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:49.503011942 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:49.503148079 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:49.503922939 CEST	12143	49831	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:49.508534908 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:49.726581097 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:49.726667881 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:49.940082073 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:49.940243006 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:50.153640985 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:50.153776884 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:50.367160082 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:50.367330074 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:50.566467047 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:50.566601992 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:50.580790997 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:50.584197044 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:50.585587025 CEST	49833	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:50.771704912 CEST	49832	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:50.779922962 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:50.797578096 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:50.797719002 CEST	12143	49833	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:50.797835112 CEST	49833	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:50.800930023 CEST	49833	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:50.985141039 CEST	12143	49832	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.013010979 CEST	12143	49833	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.013123035 CEST	49833	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:51.225366116 CEST	12143	49833	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.225457907 CEST	49833	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:51.437611103 CEST	12143	49833	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.437707901 CEST	49833	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:51.531562090 CEST	12143	49833	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.531636953 CEST	49833	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:51.537308931 CEST	49833	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:51.538687944 CEST	49834	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:51.649836063 CEST	12143	49833	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.743716002 CEST	12143	49833	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.749311924 CEST	12143	49833	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.752639055 CEST	12143	49834	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.752779961 CEST	49834	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:51.757544041 CEST	49834	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:51.971488953 CEST	12143	49834	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:51.975734949 CEST	49834	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:52.189765930 CEST	12143	49834	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:52.192625999 CEST	49834	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:52.406672955 CEST	12143	49834	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:52.409459114 CEST	49834	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:52.623501062 CEST	12143	49834	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:52.625433922 CEST	49834	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:52.822674036 CEST	12143	49834	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:52.822731972 CEST	49834	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:52.834433079 CEST	49834	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:52.836064100 CEST	49835	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:52.839432001 CEST	12143	49834	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.036717892 CEST	12143	49834	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.048377037 CEST	12143	49834	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.050585032 CEST	12143	49835	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.050753117 CEST	49835	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:53.054852962 CEST	49835	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:53.268745899 CEST	12143	49835	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.268899918 CEST	49835	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:53.482862949 CEST	12143	49835	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.483067989 CEST	49835	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:53.619735956 CEST	12143	49835	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.619803905 CEST	49835	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:53.631191969 CEST	49835	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:53.632550001 CEST	49836	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:53.697613955 CEST	12143	49835	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.833874941 CEST	12143	49835	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.845083952 CEST	12143	49835	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.847023964 CEST	12143	49836	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:53.847121954 CEST	49836	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:53.850266933 CEST	49836	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:54.064332008 CEST	12143	49836	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:54.064457893 CEST	49836	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:54.278665066 CEST	12143	49836	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:54.278795958 CEST	49836	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:54.492996931 CEST	12143	49836	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:54.493134022 CEST	49836	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:54.710675955 CEST	12143	49836	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:54.710832119 CEST	49836	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:54.915822029 CEST	12143	49836	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:54.915899038 CEST	49836	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:54.924822092 CEST	12143	49836	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:54.927959919 CEST	49836	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:54.929600954 CEST	49837	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:55.130589008 CEST	12143	49836	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.142138004 CEST	12143	49836	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.145590067 CEST	12143	49837	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.145672083 CEST	49837	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:55.149015903 CEST	49837	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:55.364470959 CEST	12143	49837	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.364597082 CEST	49837	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:55.580163956 CEST	12143	49837	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.580306053 CEST	49837	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:55.720339060 CEST	12143	49837	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.720443010 CEST	49837	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:55.724852085 CEST	49837	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:55.727091074 CEST	49838	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:55.795984983 CEST	12143	49837	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.936037064 CEST	12143	49837	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.940284014 CEST	12143	49837	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.940963030 CEST	12143	49838	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:55.941037893 CEST	49838	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:55.943743944 CEST	49838	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:56.157828093 CEST	12143	49838	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:56.157928944 CEST	49838	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:56.372704983 CEST	12143	49838	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:56.372782946 CEST	49838	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:56.555716991 CEST	12143	49838	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:56.555772066 CEST	49838	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:56.568726063 CEST	49838	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:56.571943998 CEST	49839	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:56.586613894 CEST	12143	49838	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:56.769552946 CEST	12143	49838	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:56.782522917 CEST	12143	49838	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:56.785028934 CEST	12143	49839	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:56.785203934 CEST	49839	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:56.789226055 CEST	49839	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:57.003155947 CEST	12143	49839	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:57.003292084 CEST	49839	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:57.216393948 CEST	12143	49839	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:57.216491938 CEST	49839	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:57.429749012 CEST	12143	49839	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:57.429862022 CEST	49839	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:57.643002033 CEST	12143	49839	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:57.643114090 CEST	49839	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:57.846832991 CEST	12143	49839	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:57.846961021 CEST	49839	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:57.849869013 CEST	49839	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:57.851356983 CEST	49840	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:57.856178045 CEST	12143	49839	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.060604095 CEST	12143	49839	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.062916040 CEST	12143	49839	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.067470074 CEST	12143	49840	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.067620039 CEST	49840	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:58.072536945 CEST	49840	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:58.289108038 CEST	12143	49840	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.289236069 CEST	49840	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:58.472389936 CEST	12143	49840	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.472490072 CEST	49840	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:58.474842072 CEST	49840	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:58.505492926 CEST	12143	49840	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.589910984 CEST	49841	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:58.688540936 CEST	12143	49840	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.690921068 CEST	12143	49840	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.804342031 CEST	12143	49841	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:58.804492950 CEST	49841	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:58.807030916 CEST	49841	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:59.021230936 CEST	12143	49841	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:59.021313906 CEST	49841	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:59.235450983 CEST	12143	49841	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:59.287121058 CEST	49841	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:59.310328007 CEST	12143	49841	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:59.310462952 CEST	49841	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:59.318526983 CEST	49841	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:59.319896936 CEST	49842	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:59.501211882 CEST	12143	49841	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:59.524497986 CEST	12143	49841	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:59.532536030 CEST	12143	49841	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:59.534625053 CEST	12143	49842	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:59.534698009 CEST	49842	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:59.546636105 CEST	49842	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:59.761432886 CEST	12143	49842	3.125.102.39	192.168.2.5
Apr 25, 2024 00:49:59.761514902 CEST	49842	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:49:59.976279974 CEST	12143	49842	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:00.407192945 CEST	12143	49842	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:00.407313108 CEST	49842	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:00.761107922 CEST	49842	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:00.796863079 CEST	49843	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:00.975996971 CEST	12143	49842	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:01.010544062 CEST	12143	49843	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:01.010667086 CEST	49843	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:01.034235001 CEST	49843	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:01.247859001 CEST	12143	49843	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:01.248018026 CEST	49843	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:01.432317972 CEST	12143	49843	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:01.432465076 CEST	49843	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:01.443588972 CEST	49843	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:01.445070028 CEST	49844	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:01.461651087 CEST	12143	49843	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:01.646142006 CEST	12143	49843	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:01.657208920 CEST	12143	49843	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:01.660351038 CEST	12143	49844	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:01.660450935 CEST	49844	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:01.663491964 CEST	49844	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:01.878731012 CEST	12143	49844	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:01.878885031 CEST	49844	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:02.094254971 CEST	12143	49844	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:02.094384909 CEST	49844	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:02.309848070 CEST	12143	49844	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:02.310017109 CEST	49844	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:02.525373936 CEST	12143	49844	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:02.525544882 CEST	49844	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:02.701950073 CEST	12143	49844	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:02.702136993 CEST	49844	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:02.709201097 CEST	49844	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:02.710510015 CEST	49845	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:02.740900040 CEST	12143	49844	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:02.917443991 CEST	12143	49844	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:02.924520016 CEST	12143	49844	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:02.925693989 CEST	12143	49845	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:02.925810099 CEST	49845	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:02.928788900 CEST	49845	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:03.145757914 CEST	12143	49845	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:03.145931959 CEST	49845	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:03.320668936 CEST	12143	49845	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:03.320739985 CEST	49845	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:03.334338903 CEST	49845	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:03.339029074 CEST	49846	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:03.361104012 CEST	12143	49845	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:03.536000013 CEST	12143	49845	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:03.549483061 CEST	12143	49845	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:03.554261923 CEST	12143	49846	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:03.554485083 CEST	49846	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:03.558975935 CEST	49846	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:03.774305105 CEST	12143	49846	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:03.774477959 CEST	49846	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:03.989801884 CEST	12143	49846	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:03.989906073 CEST	49846	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:04.205164909 CEST	12143	49846	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:04.205359936 CEST	49846	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:04.280677080 CEST	12143	49846	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:04.280792952 CEST	49846	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:04.287323952 CEST	49846	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:04.289055109 CEST	49847	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:04.420583963 CEST	12143	49846	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:04.498243093 CEST	12143	49846	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:04.503926992 CEST	12143	49846	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:04.504086018 CEST	12143	49847	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:04.504184961 CEST	49847	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:04.507432938 CEST	49847	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:04.722428083 CEST	12143	49847	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:04.722520113 CEST	49847	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:04.936014891 CEST	12143	49847	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:04.936180115 CEST	49847	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:05.149550915 CEST	12143	49847	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:05.149638891 CEST	49847	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:05.228166103 CEST	12143	49847	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:05.228363037 CEST	49847	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:05.240469933 CEST	49847	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:05.242266893 CEST	49848	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:05.363415956 CEST	12143	49847	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:05.441521883 CEST	12143	49847	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:05.453609943 CEST	12143	49847	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:05.457952976 CEST	12143	49848	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:05.458113909 CEST	49848	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:05.461549997 CEST	49848	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:05.677123070 CEST	12143	49848	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:05.677206039 CEST	49848	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:05.892785072 CEST	12143	49848	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:05.892873049 CEST	49848	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:06.108483076 CEST	12143	49848	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:06.108644009 CEST	49848	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:06.179403067 CEST	12143	49848	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:06.179533005 CEST	49848	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:06.180506945 CEST	49848	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:06.182009935 CEST	49849	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:06.324296951 CEST	12143	49848	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:06.396313906 CEST	12143	49848	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:06.396365881 CEST	12143	49848	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:06.397298098 CEST	12143	49849	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:06.397392988 CEST	49849	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:06.400019884 CEST	49849	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:06.615557909 CEST	12143	49849	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:06.615742922 CEST	49849	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:06.831356049 CEST	12143	49849	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:06.831464052 CEST	49849	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.047152996 CEST	12143	49849	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:07.047277927 CEST	49849	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.118092060 CEST	12143	49849	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:07.118249893 CEST	49849	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.118609905 CEST	49849	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.119920015 CEST	49850	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.262644053 CEST	12143	49849	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:07.332667112 CEST	12143	49850	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:07.332881927 CEST	49850	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.333405018 CEST	12143	49849	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:07.333745003 CEST	12143	49849	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:07.335999966 CEST	49850	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.548947096 CEST	12143	49850	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:07.549051046 CEST	49850	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.761898041 CEST	12143	49850	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:07.762005091 CEST	49850	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.831211090 CEST	12143	49850	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:07.831324100 CEST	49850	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.831931114 CEST	49850	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.835238934 CEST	49851	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:07.974970102 CEST	12143	49850	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.044079065 CEST	12143	49850	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.044487000 CEST	12143	49850	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.047327995 CEST	12143	49851	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.047418118 CEST	49851	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:08.049827099 CEST	49851	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:08.262072086 CEST	12143	49851	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.262223005 CEST	49851	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:08.474528074 CEST	12143	49851	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.474719048 CEST	49851	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:08.686908007 CEST	12143	49851	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.687005043 CEST	49851	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:08.763972998 CEST	12143	49851	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.764056921 CEST	49851	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:08.764388084 CEST	49851	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:08.765582085 CEST	49852	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:08.899265051 CEST	12143	49851	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.976162910 CEST	12143	49851	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.976342916 CEST	12143	49851	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.979475021 CEST	12143	49852	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:08.979609966 CEST	49852	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:08.982609987 CEST	49852	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:09.196405888 CEST	12143	49852	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:09.197408915 CEST	49852	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:09.412480116 CEST	12143	49852	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:09.417468071 CEST	49852	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:09.631421089 CEST	12143	49852	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:09.636039972 CEST	49852	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:09.821621895 CEST	12143	49852	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:09.821760893 CEST	49852	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:09.822015047 CEST	49852	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:09.823477030 CEST	49853	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:09.849906921 CEST	12143	49852	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.035701036 CEST	12143	49852	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.035764933 CEST	12143	49852	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.037870884 CEST	12143	49853	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.037957907 CEST	49853	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:10.040349007 CEST	49853	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:10.254731894 CEST	12143	49853	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.254874945 CEST	49853	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:10.469424009 CEST	12143	49853	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.469590902 CEST	49853	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:10.684067965 CEST	12143	49853	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.684145927 CEST	49853	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:10.702119112 CEST	12143	49853	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.702178955 CEST	49853	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:10.702302933 CEST	49853	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:10.704329014 CEST	49854	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:10.898634911 CEST	12143	49853	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.916594028 CEST	12143	49853	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.916646957 CEST	12143	49853	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.919608116 CEST	12143	49854	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:10.921380043 CEST	49854	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:10.923827887 CEST	49854	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:11.139247894 CEST	12143	49854	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:11.139614105 CEST	49854	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:11.355258942 CEST	12143	49854	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:11.355364084 CEST	49854	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:11.572407961 CEST	12143	49854	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:11.575434923 CEST	49854	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:11.602382898 CEST	12143	49854	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:11.603395939 CEST	49854	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:11.603965044 CEST	49854	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:11.605289936 CEST	49855	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:11.791099072 CEST	12143	49854	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:11.818778038 CEST	12143	49854	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:11.819132090 CEST	12143	49855	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:11.819230080 CEST	12143	49854	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:11.819236994 CEST	49855	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:11.822550058 CEST	49855	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:12.036393881 CEST	12143	49855	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:12.036590099 CEST	49855	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:12.250452042 CEST	12143	49855	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:12.250544071 CEST	49855	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:12.317370892 CEST	12143	49855	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:12.317508936 CEST	49855	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:12.317794085 CEST	49855	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:12.319084883 CEST	49856	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:12.464442968 CEST	12143	49855	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:12.531003952 CEST	12143	49856	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:12.531111956 CEST	49856	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:12.531148911 CEST	12143	49855	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:12.531321049 CEST	12143	49855	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:12.534157038 CEST	49856	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:12.747062922 CEST	12143	49856	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:12.747196913 CEST	49856	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:12.960741997 CEST	12143	49856	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:12.963404894 CEST	49856	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:13.175818920 CEST	12143	49856	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:13.175952911 CEST	49856	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:13.287349939 CEST	12143	49856	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:13.291379929 CEST	49856	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:13.291521072 CEST	49856	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:13.292761087 CEST	49857	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:13.388241053 CEST	12143	49856	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:13.503622055 CEST	12143	49856	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:13.503670931 CEST	12143	49856	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:13.506337881 CEST	12143	49857	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:13.507422924 CEST	49857	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:13.509871960 CEST	49857	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:13.723571062 CEST	12143	49857	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:13.727596998 CEST	49857	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:13.941574097 CEST	12143	49857	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:13.941739082 CEST	49857	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.155608892 CEST	12143	49857	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:14.155833006 CEST	49857	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.158829927 CEST	12143	49857	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:14.158927917 CEST	49857	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.159486055 CEST	49857	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.162692070 CEST	49858	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.369857073 CEST	12143	49857	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:14.372558117 CEST	12143	49857	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:14.373034954 CEST	12143	49857	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:14.374900103 CEST	12143	49858	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:14.374960899 CEST	49858	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.378165007 CEST	49858	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.590496063 CEST	12143	49858	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:14.590648890 CEST	49858	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.803174973 CEST	12143	49858	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:14.803337097 CEST	49858	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.807467937 CEST	12143	49858	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:14.807543993 CEST	49858	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.807768106 CEST	49858	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:14.809159040 CEST	49859	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:15.015638113 CEST	12143	49858	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:15.019798040 CEST	12143	49858	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:15.019840002 CEST	12143	49858	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:15.025285006 CEST	12143	49859	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:15.025474072 CEST	49859	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:15.028074980 CEST	49859	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:15.244231939 CEST	12143	49859	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:15.244343042 CEST	49859	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:15.460467100 CEST	12143	49859	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:15.460566044 CEST	49859	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:15.676789999 CEST	12143	49859	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:15.676937103 CEST	49859	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:15.893155098 CEST	12143	49859	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:15.893316031 CEST	49859	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:16.065589905 CEST	12143	49859	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:16.065706968 CEST	49859	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:16.066011906 CEST	49859	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:16.067406893 CEST	49860	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:16.109486103 CEST	12143	49859	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:16.279232025 CEST	12143	49860	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:16.279319048 CEST	49860	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:16.281869888 CEST	49860	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:16.281877041 CEST	12143	49859	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:16.282021999 CEST	12143	49859	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:16.494962931 CEST	12143	49860	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:16.495093107 CEST	49860	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:16.707040071 CEST	12143	49860	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:16.778106928 CEST	49860	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:16.992772102 CEST	12143	49860	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:16.992917061 CEST	49860	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:17.205153942 CEST	12143	49860	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:17.205300093 CEST	49860	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:17.308975935 CEST	12143	49860	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:17.309216022 CEST	49860	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:17.418118954 CEST	12143	49860	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:17.521002054 CEST	12143	49860	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:18.207720041 CEST	49861	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:18.422971964 CEST	12143	49861	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:18.423115969 CEST	49861	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:18.425767899 CEST	49861	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:18.640717030 CEST	12143	49861	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:18.640801907 CEST	49861	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:18.842025995 CEST	12143	49861	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:18.842170954 CEST	49861	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:18.843017101 CEST	49861	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:18.844515085 CEST	49862	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:18.855817080 CEST	12143	49861	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.060149908 CEST	12143	49861	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.060193062 CEST	12143	49861	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.061839104 CEST	12143	49862	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.061939955 CEST	49862	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:19.064774990 CEST	49862	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:19.279664993 CEST	12143	49862	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.279792070 CEST	49862	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:19.494802952 CEST	12143	49862	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.494898081 CEST	49862	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:19.709906101 CEST	12143	49862	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.710074902 CEST	49862	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:19.756963968 CEST	12143	49862	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.757074118 CEST	49862	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:19.757885933 CEST	49862	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:19.759135008 CEST	49863	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:19.925095081 CEST	12143	49862	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.972217083 CEST	12143	49862	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.973326921 CEST	12143	49862	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.973351002 CEST	12143	49863	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:19.973500967 CEST	49863	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:19.976914883 CEST	49863	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:20.191133976 CEST	12143	49863	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:20.191242933 CEST	49863	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:20.405572891 CEST	12143	49863	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:20.405711889 CEST	49863	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:20.620156050 CEST	12143	49863	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:20.620265961 CEST	49863	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:20.834492922 CEST	12143	49863	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:20.837440968 CEST	49863	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.010929108 CEST	12143	49863	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.013418913 CEST	49863	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.015230894 CEST	49863	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.016495943 CEST	49864	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.051812887 CEST	12143	49863	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.227633953 CEST	12143	49863	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.229356050 CEST	12143	49863	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.230304003 CEST	12143	49864	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.230376959 CEST	49864	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.234586000 CEST	49864	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.448467970 CEST	12143	49864	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.448575974 CEST	49864	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.591106892 CEST	12143	49864	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.591428995 CEST	49864	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.591654062 CEST	49864	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.592993975 CEST	49865	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.662528992 CEST	12143	49864	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.805373907 CEST	12143	49864	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.805432081 CEST	12143	49864	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.805738926 CEST	12143	49865	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:21.808408022 CEST	49865	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:21.810842037 CEST	49865	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:22.023677111 CEST	12143	49865	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:22.023773909 CEST	49865	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:22.236634970 CEST	12143	49865	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:22.236803055 CEST	49865	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:22.262891054 CEST	12143	49865	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:22.262998104 CEST	49865	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:22.263133049 CEST	49865	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:22.264439106 CEST	49866	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:22.449898958 CEST	12143	49865	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:22.476790905 CEST	12143	49865	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:22.476810932 CEST	12143	49865	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:22.480853081 CEST	12143	49866	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:22.481024981 CEST	49866	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:22.483591080 CEST	49866	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:22.699826002 CEST	12143	49866	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:22.700007915 CEST	49866	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:22.916235924 CEST	12143	49866	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:22.916568995 CEST	49866	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:23.132872105 CEST	12143	49866	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:23.136040926 CEST	49866	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:23.285422087 CEST	12143	49866	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:23.287446022 CEST	49866	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:23.287545919 CEST	49866	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:23.288779020 CEST	49867	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:23.352298975 CEST	12143	49866	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:23.502428055 CEST	12143	49867	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:23.503807068 CEST	12143	49866	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:23.503856897 CEST	49867	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:23.503912926 CEST	12143	49866	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:23.507278919 CEST	49867	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:23.720752954 CEST	12143	49867	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:23.722142935 CEST	49867	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:23.937200069 CEST	12143	49867	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:23.937230110 CEST	12143	49867	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:23.937371969 CEST	49867	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:24.003257990 CEST	12143	49867	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:24.003336906 CEST	49867	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:24.003772974 CEST	49867	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:24.005095005 CEST	49868	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:24.150993109 CEST	12143	49867	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:24.216908932 CEST	12143	49867	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:24.217180967 CEST	12143	49867	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:24.219031096 CEST	12143	49868	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:24.219158888 CEST	49868	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:24.222069979 CEST	49868	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:24.436027050 CEST	12143	49868	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:24.436208963 CEST	49868	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:24.650268078 CEST	12143	49868	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:24.650484085 CEST	49868	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:24.864536047 CEST	12143	49868	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:24.864648104 CEST	49868	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:25.078640938 CEST	12143	49868	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:25.078784943 CEST	49868	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:25.083596945 CEST	12143	49868	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:25.083683968 CEST	49868	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:25.083869934 CEST	49868	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:25.085207939 CEST	49869	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:25.292784929 CEST	12143	49868	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:25.297245979 CEST	12143	49869	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:25.297343969 CEST	49869	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:25.297560930 CEST	12143	49868	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:25.297666073 CEST	12143	49868	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:25.299879074 CEST	49869	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:25.511995077 CEST	12143	49869	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:25.512109995 CEST	49869	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:25.724788904 CEST	12143	49869	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:25.725090027 CEST	49869	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:25.937377930 CEST	12143	49869	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:25.937567949 CEST	49869	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.011691093 CEST	12143	49869	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:26.011847019 CEST	49869	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.012162924 CEST	49869	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.013686895 CEST	49870	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.149887085 CEST	12143	49869	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:26.223997116 CEST	12143	49869	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:26.224260092 CEST	12143	49869	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:26.227827072 CEST	12143	49870	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:26.227946043 CEST	49870	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.230488062 CEST	49870	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.444614887 CEST	12143	49870	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:26.444725990 CEST	49870	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.658884048 CEST	12143	49870	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:26.659179926 CEST	49870	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.873393059 CEST	12143	49870	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:26.873542070 CEST	49870	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.925466061 CEST	12143	49870	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:26.925530910 CEST	49870	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.925673008 CEST	49870	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:26.926853895 CEST	49871	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:27.087708950 CEST	12143	49870	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:27.139707088 CEST	12143	49870	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:27.139759064 CEST	12143	49870	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:27.141567945 CEST	12143	49871	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:27.141675949 CEST	49871	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:27.144262075 CEST	49871	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:27.359040022 CEST	12143	49871	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:27.359317064 CEST	49871	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:27.574029922 CEST	12143	49871	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:27.574184895 CEST	49871	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:27.788943052 CEST	12143	49871	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:27.789072990 CEST	49871	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:27.839725971 CEST	12143	49871	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:27.839889050 CEST	49871	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:27.840410948 CEST	49871	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:27.842021942 CEST	49872	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:28.003993988 CEST	12143	49871	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.054553986 CEST	12143	49871	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.055139065 CEST	12143	49871	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.055205107 CEST	12143	49872	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.055275917 CEST	49872	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:28.058043003 CEST	49872	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:28.271111965 CEST	12143	49872	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.271246910 CEST	49872	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:28.482028008 CEST	12143	49872	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.482112885 CEST	49872	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:28.482373953 CEST	49872	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:28.483738899 CEST	49873	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:28.484518051 CEST	12143	49872	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.695242882 CEST	12143	49872	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.695398092 CEST	12143	49872	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.700381041 CEST	12143	49873	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.700481892 CEST	49873	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:28.702815056 CEST	49873	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:28.920032978 CEST	12143	49873	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:28.920114040 CEST	49873	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:29.136715889 CEST	12143	49873	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:29.136848927 CEST	49873	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:29.353665113 CEST	12143	49873	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:29.353760004 CEST	49873	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:29.392683983 CEST	12143	49873	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:29.392767906 CEST	49873	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:29.393049002 CEST	49873	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:29.394288063 CEST	49874	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:29.570355892 CEST	12143	49873	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:29.609276056 CEST	12143	49874	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:29.609323025 CEST	12143	49873	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:29.609440088 CEST	12143	49873	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:29.609489918 CEST	49874	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:29.611673117 CEST	49874	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:29.822678089 CEST	49874	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:29.826152086 CEST	12143	49874	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.037442923 CEST	12143	49874	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.037550926 CEST	12143	49874	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.037763119 CEST	49874	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:30.247720957 CEST	12143	49874	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.247963905 CEST	49874	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:30.248590946 CEST	49874	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:30.249950886 CEST	49875	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:30.252263069 CEST	12143	49874	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.460515022 CEST	49874	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:30.462466002 CEST	12143	49874	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.462991953 CEST	12143	49874	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.464639902 CEST	12143	49875	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.464745998 CEST	49875	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:30.470374107 CEST	49875	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:30.675147057 CEST	12143	49874	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.684959888 CEST	12143	49875	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.685115099 CEST	49875	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:30.899941921 CEST	12143	49875	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:30.900088072 CEST	49875	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:31.070561886 CEST	12143	49875	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:31.070655107 CEST	49875	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:31.071311951 CEST	49875	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:31.073317051 CEST	49876	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:31.114871025 CEST	12143	49875	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:31.285352945 CEST	12143	49875	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:31.285877943 CEST	12143	49875	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:31.287257910 CEST	12143	49876	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:31.287347078 CEST	49876	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:31.290147066 CEST	49876	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:31.504249096 CEST	12143	49876	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:31.504362106 CEST	49876	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:31.718483925 CEST	12143	49876	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:31.718621016 CEST	49876	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:31.932787895 CEST	12143	49876	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:31.932893038 CEST	49876	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:32.147429943 CEST	12143	49876	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:32.147617102 CEST	49876	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:32.307895899 CEST	12143	49876	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:32.307982922 CEST	49876	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:32.308248043 CEST	49876	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:32.309775114 CEST	49877	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:32.361490011 CEST	12143	49876	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:32.521863937 CEST	12143	49876	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:32.522131920 CEST	12143	49876	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:32.525003910 CEST	12143	49877	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:32.525088072 CEST	49877	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:32.527376890 CEST	49877	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:32.742439985 CEST	12143	49877	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:32.742537022 CEST	49877	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:32.957699060 CEST	12143	49877	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:32.957799911 CEST	49877	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:33.083367109 CEST	12143	49877	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:33.083488941 CEST	49877	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:33.083825111 CEST	49877	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:33.085189104 CEST	49878	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:33.172985077 CEST	12143	49877	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:33.298840046 CEST	12143	49877	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:33.298894882 CEST	12143	49877	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:33.299237013 CEST	12143	49878	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:33.299321890 CEST	49878	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:33.301819086 CEST	49878	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:33.515965939 CEST	12143	49878	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:33.516119003 CEST	49878	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:33.730870008 CEST	12143	49878	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:33.947338104 CEST	12143	49878	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:33.947454929 CEST	49878	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:34.007823944 CEST	49878	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:34.011681080 CEST	49879	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:34.221925974 CEST	12143	49878	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:34.225370884 CEST	12143	49879	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:34.225460052 CEST	49879	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:34.227675915 CEST	49879	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:34.441467047 CEST	12143	49879	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:34.441584110 CEST	49879	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:34.655469894 CEST	12143	49879	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:35.085742950 CEST	12143	49879	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:35.085824013 CEST	49879	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:35.622994900 CEST	49879	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:35.624264002 CEST	49880	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:35.836802006 CEST	12143	49879	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:35.837852001 CEST	12143	49880	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:35.837975025 CEST	49880	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:35.843702078 CEST	49880	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:36.054517031 CEST	49880	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:36.057076931 CEST	12143	49880	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.267977953 CEST	12143	49880	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.268019915 CEST	12143	49880	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.268080950 CEST	49880	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:36.481621027 CEST	12143	49880	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.481728077 CEST	49880	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:36.521915913 CEST	12143	49880	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.522066116 CEST	49880	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:36.522855043 CEST	49880	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:36.529424906 CEST	49881	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:36.695677042 CEST	12143	49880	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.735795021 CEST	12143	49880	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.736231089 CEST	12143	49880	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.744764090 CEST	12143	49881	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.744930983 CEST	49881	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:36.747529984 CEST	49881	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:36.963073969 CEST	12143	49881	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:36.963258028 CEST	49881	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:37.178544998 CEST	12143	49881	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:37.178673983 CEST	49881	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:37.393928051 CEST	12143	49881	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:37.394047976 CEST	49881	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:37.609410048 CEST	12143	49881	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:37.609585047 CEST	49881	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:37.780287027 CEST	12143	49881	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:37.780359983 CEST	49881	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:37.780662060 CEST	49881	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:37.787333012 CEST	49882	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:37.824799061 CEST	12143	49881	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:37.996745110 CEST	12143	49881	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:37.997026920 CEST	12143	49881	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:38.004451036 CEST	12143	49882	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:38.004534960 CEST	49882	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:38.007019043 CEST	49882	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:38.222979069 CEST	12143	49882	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:38.223176956 CEST	49882	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:38.384042978 CEST	12143	49882	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:38.384239912 CEST	49882	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:38.384393930 CEST	49882	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:38.385699987 CEST	49883	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:38.439012051 CEST	12143	49882	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:38.600006104 CEST	12143	49883	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:38.600117922 CEST	49883	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:38.600930929 CEST	12143	49882	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:38.600975990 CEST	12143	49882	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:38.602375984 CEST	49883	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:38.816255093 CEST	12143	49883	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:38.816416979 CEST	49883	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:39.030436993 CEST	12143	49883	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:39.030584097 CEST	49883	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:39.096466064 CEST	12143	49883	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:39.096575975 CEST	49883	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:39.097115040 CEST	49883	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:39.098469973 CEST	49884	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:39.244565010 CEST	12143	49883	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:39.310411930 CEST	12143	49883	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:39.310817003 CEST	12143	49883	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:39.312524080 CEST	12143	49884	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:39.312623024 CEST	49884	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:39.314933062 CEST	49884	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:39.529027939 CEST	12143	49884	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:39.529200077 CEST	49884	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:39.743432045 CEST	12143	49884	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:39.743609905 CEST	49884	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:39.957773924 CEST	12143	49884	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:39.957878113 CEST	49884	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:40.171956062 CEST	12143	49884	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:40.172126055 CEST	49884	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:40.338464975 CEST	12143	49884	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:40.338551044 CEST	49884	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:40.339039087 CEST	49884	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:40.340446949 CEST	49885	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:40.386179924 CEST	12143	49884	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:40.552577972 CEST	12143	49884	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:40.552926064 CEST	12143	49884	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:40.555685997 CEST	12143	49885	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:40.555789948 CEST	49885	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:40.557827950 CEST	49885	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:40.773170948 CEST	12143	49885	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:40.773328066 CEST	49885	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:40.990185976 CEST	12143	49885	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:40.990355015 CEST	49885	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:41.200186968 CEST	12143	49885	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:41.200562954 CEST	49885	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:41.200957060 CEST	49885	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:41.203890085 CEST	49886	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:41.205610991 CEST	12143	49885	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:41.415887117 CEST	12143	49885	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:41.416186094 CEST	12143	49885	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:41.417821884 CEST	12143	49886	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:41.417912960 CEST	49886	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:41.420660973 CEST	49886	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:41.635301113 CEST	12143	49886	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:41.635505915 CEST	49886	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:41.849680901 CEST	12143	49886	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:41.849805117 CEST	49886	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:42.063769102 CEST	12143	49886	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:42.063901901 CEST	49886	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:42.113620043 CEST	12143	49886	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:42.113751888 CEST	49886	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:42.114011049 CEST	49886	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:42.116853952 CEST	49887	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:42.277798891 CEST	12143	49886	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:42.327747107 CEST	12143	49886	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:42.327776909 CEST	12143	49886	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:42.330137014 CEST	12143	49887	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:42.330336094 CEST	49887	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:42.332746983 CEST	49887	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:42.545751095 CEST	12143	49887	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:42.545909882 CEST	49887	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:42.759206057 CEST	12143	49887	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:42.759335995 CEST	49887	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:42.972517967 CEST	12143	49887	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:42.973386049 CEST	49887	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.186866999 CEST	12143	49887	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:43.188770056 CEST	49887	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.226504087 CEST	12143	49887	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:43.226593018 CEST	49887	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.226792097 CEST	49887	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.230433941 CEST	49888	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.401984930 CEST	12143	49887	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:43.439897060 CEST	12143	49887	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:43.439953089 CEST	12143	49887	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:43.444173098 CEST	12143	49888	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:43.444310904 CEST	49888	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.447026968 CEST	49888	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.660871029 CEST	12143	49888	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:43.661365032 CEST	49888	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.875242949 CEST	12143	49888	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:43.875350952 CEST	49888	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.992486954 CEST	12143	49888	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:43.992687941 CEST	49888	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.993051052 CEST	49888	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:43.994486094 CEST	49889	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:44.089291096 CEST	12143	49888	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:44.206433058 CEST	12143	49888	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:44.206619024 CEST	12143	49888	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:44.206765890 CEST	12143	49889	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:44.206857920 CEST	49889	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:44.209383011 CEST	49889	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:44.421749115 CEST	12143	49889	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:44.421982050 CEST	49889	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:44.634357929 CEST	12143	49889	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:44.634462118 CEST	49889	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:44.848761082 CEST	12143	49889	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:44.848889112 CEST	49889	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:44.923194885 CEST	12143	49889	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:44.923289061 CEST	49889	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:44.923890114 CEST	49889	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:44.925302982 CEST	49890	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:45.063577890 CEST	12143	49889	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:45.135576963 CEST	12143	49889	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:45.136058092 CEST	12143	49889	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:45.141779900 CEST	12143	49890	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:45.141896009 CEST	49890	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:45.146394968 CEST	49890	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:45.363049984 CEST	12143	49890	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:45.363214016 CEST	49890	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:45.580018044 CEST	12143	49890	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:45.580167055 CEST	49890	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:45.796897888 CEST	12143	49890	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:45.797028065 CEST	49890	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.014250040 CEST	12143	49890	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:46.014328003 CEST	49890	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.154485941 CEST	12143	49890	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:46.154558897 CEST	49890	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.155659914 CEST	49890	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.157423973 CEST	49891	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.231025934 CEST	12143	49890	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:46.371253014 CEST	12143	49890	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:46.371445894 CEST	12143	49891	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:46.371519089 CEST	49891	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.371943951 CEST	12143	49890	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:46.373857975 CEST	49891	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.588011980 CEST	12143	49891	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:46.588119984 CEST	49891	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.802371979 CEST	12143	49891	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:46.802460909 CEST	49891	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.848609924 CEST	12143	49891	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:46.848669052 CEST	49891	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.848889112 CEST	49891	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:46.850544930 CEST	49892	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:47.016711950 CEST	12143	49891	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:47.062763929 CEST	12143	49891	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:47.062944889 CEST	12143	49891	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:47.068532944 CEST	12143	49892	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:47.071573019 CEST	49892	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:47.074202061 CEST	49892	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:47.290425062 CEST	12143	49892	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:47.290539026 CEST	49892	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:47.506736994 CEST	12143	49892	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:47.507400990 CEST	49892	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:47.754776955 CEST	12143	49892	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:47.755399942 CEST	49892	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:47.971506119 CEST	12143	49892	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:47.971738100 CEST	49892	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.126398087 CEST	12143	49892	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:48.126473904 CEST	49892	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.127007961 CEST	49892	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.133076906 CEST	49893	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.187942982 CEST	12143	49892	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:48.342586040 CEST	12143	49892	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:48.342933893 CEST	12143	49892	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:48.349210024 CEST	12143	49893	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:48.349421978 CEST	49893	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.351919889 CEST	49893	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.568547010 CEST	12143	49893	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:48.568645000 CEST	49893	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.785007954 CEST	12143	49893	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:48.785145044 CEST	49893	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.798302889 CEST	12143	49893	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:48.798428059 CEST	49893	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.798630953 CEST	49893	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:48.800050974 CEST	49894	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:49.003726959 CEST	12143	49893	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.014482975 CEST	12143	49893	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.014611006 CEST	12143	49893	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.015724897 CEST	12143	49894	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.015894890 CEST	49894	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:49.018635988 CEST	49894	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:49.234545946 CEST	12143	49894	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.235388041 CEST	49894	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:49.406058073 CEST	12143	49894	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.409347057 CEST	49894	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:49.409574032 CEST	49894	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:49.410896063 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:49.451127052 CEST	12143	49894	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.625026941 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.625096083 CEST	12143	49894	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.625293016 CEST	12143	49894	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.625375032 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:49.627911091 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:49.842032909 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:49.844906092 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:50.059051037 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:50.059320927 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:50.273468971 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:50.273682117 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:50.487938881 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:50.488058090 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:50.682446003 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:50.682537079 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:50.682900906 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:50.685075998 CEST	49896	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:50.702179909 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:50.849677086 CEST	49895	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:50.900001049 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:50.900085926 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:50.903837919 CEST	12143	49896	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:50.907452106 CEST	49896	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:50.963248014 CEST	49896	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:51.063818932 CEST	12143	49895	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:51.178978920 CEST	12143	49896	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:51.181361914 CEST	49896	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:51.397234917 CEST	12143	49896	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:51.658638954 CEST	12143	49896	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:51.661397934 CEST	49896	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:51.737020969 CEST	49896	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:51.738692045 CEST	49897	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:51.952780962 CEST	12143	49896	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:51.955682993 CEST	12143	49897	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:51.955784082 CEST	49897	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:53.907170057 CEST	49897	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:54.124172926 CEST	12143	49897	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:54.124278069 CEST	49897	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:54.341275930 CEST	12143	49897	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:54.341423035 CEST	49897	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:54.398845911 CEST	12143	49897	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:54.398956060 CEST	49897	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:54.399333000 CEST	49897	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:54.401036024 CEST	49898	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:54.558351994 CEST	12143	49897	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:54.615550995 CEST	12143	49898	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:54.615674019 CEST	49898	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:54.615727901 CEST	12143	49897	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:54.616061926 CEST	12143	49897	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:54.618364096 CEST	49898	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:54.832890034 CEST	12143	49898	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:54.832997084 CEST	49898	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:55.048264980 CEST	12143	49898	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:55.048371077 CEST	49898	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:55.262818098 CEST	12143	49898	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:55.262948990 CEST	49898	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:55.333081007 CEST	12143	49898	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:55.333184958 CEST	49898	12143	192.168.2.5	3.125.102.39
Apr 25, 2024 00:50:55.477446079 CEST	12143	49898	3.125.102.39	192.168.2.5
Apr 25, 2024 00:50:55.547694921 CEST	12143	49898	3.125.102.39	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 25, 2024 00:46:57.460989952 CEST	53067	53	192.168.2.5	1.1.1.1
Apr 25, 2024 00:46:57.573647022 CEST	53	53067	1.1.1.1	192.168.2.5
Apr 25, 2024 00:47:58.104177952 CEST	49667	53	192.168.2.5	1.1.1.1
Apr 25, 2024 00:47:58.216309071 CEST	53	49667	1.1.1.1	192.168.2.5
Apr 25, 2024 00:48:58.429347038 CEST	54914	53	192.168.2.5	1.1.1.1
Apr 25, 2024 00:48:58.544048071 CEST	53	54914	1.1.1.1	192.168.2.5
Apr 25, 2024 00:49:58.476337910 CEST	58155	53	192.168.2.5	1.1.1.1
Apr 25, 2024 00:49:58.588601112 CEST	53	58155	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 25, 2024 00:46:57.460989952 CEST	192.168.2.5	1.1.1.1	0x2257	Standard query (0)	0.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Apr 25, 2024 00:47:58.104177952 CEST	192.168.2.5	1.1.1.1	0xb73c	Standard query (0)	0.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Apr 25, 2024 00:48:58.429347038 CEST	192.168.2.5	1.1.1.1	0xf4	Standard query (0)	0.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false
Apr 25, 2024 00:49:58.476337910 CEST	192.168.2.5	1.1.1.1	0x753c	Standard query (0)	0.tcp.eu.ngrok.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 25, 2024 00:46:57.573647022 CEST	1.1.1.1	192.168.2.5	0x2257	No error (0)	0.tcp.eu.ngrok.io	3.124.142.205	A (IP address)	IN (0x0001)	false
Apr 25, 2024 00:47:58.216309071 CEST	1.1.1.1	192.168.2.5	0xb73c	No error (0)	0.tcp.eu.ngrok.io	3.125.102.39	A (IP address)	IN (0x0001)	false
Apr 25, 2024 00:48:58.544048071 CEST	1.1.1.1	192.168.2.5	0xf4	No error (0)	0.tcp.eu.ngrok.io	3.125.102.39	A (IP address)	IN (0x0001)	false
Apr 25, 2024 00:49:58.588601112 CEST	1.1.1.1	192.168.2.5	0x753c	No error (0)	0.tcp.eu.ngrok.io	3.125.102.39	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	00:46:48
Start date:	25/04/2024
Path:	C:\Users\user\Desktop\jpGSWjSTSw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\jpGSWjSTSw.exe"
Imagebase:	0x7e0000
File size:	37'888 bytes
MD5 hash:	B1048F879FA97D356045037BDDC4ADD3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Njrat_30f3c220, Description: unknown, Source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown Rule: njrat1, Description: Identify njRat, Source: 00000000.00000000.1961456863.00000000007E2000.00000002.00000001.01000000.00000003.sdmp, Author: Brian Wallace @botnet_hunter Rule: JoeSecurity_Njrat, Description: Yara detected Njrat, Source: 00000000.00000002.4421743474.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:46:54
Start date:	25/04/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Users\user\Desktop\jpGSWjSTSw.exe" "jpGSWjSTSw.exe" ENABLE
Imagebase:	0x1080000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:46:54
Start date:	25/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	5.2%
Total number of Nodes:	134
Total number of Limit Nodes:	6

Executed Functions

Function 00DBB17F Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00DBB1FF

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: e74836a1ae99af524dfaf29751a6689ee843316ccf25deb8152a3709c932aab7
Instruction ID: 6e1e7f2480cd4a8a9f8514009825740943aa909417474ad8cc54e2d54384e540
Opcode Fuzzy Hash: e74836a1ae99af524dfaf29751a6689ee843316ccf25deb8152a3709c932aab7
Instruction Fuzzy Hash: 5E21BF75509784AFDB228F25DC40B92BFB4EF06320F0884DAE9858F563D370E908DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB3BB Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 00DBB431

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 91aa2facdd7284d7f2e1e0a0ffb5b9b8dd7987e2267aeebd9685fe8e4027165d
Instruction ID: 2bffc35cde0829ed0689839bbed07f4d05e26b097d1f1fdfbd53b339abf3fcea
Opcode Fuzzy Hash: 91aa2facdd7284d7f2e1e0a0ffb5b9b8dd7987e2267aeebd9685fe8e4027165d
Instruction Fuzzy Hash: 9D219D714097C0AFDB228B21DC45A52BFB0EF16324F0980CBE9858B1A3D265A909DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB1B6 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 00DBB1FF

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 704b898bdf7ba3288e2ef42f3e7a20c9be2659f6ec44ecb04c227b6367794b03
Instruction ID: 248d438807302e918ba26e293868eb9fe0dd6c035f50b25e9fbfd2c451ad2ba4
Opcode Fuzzy Hash: 704b898bdf7ba3288e2ef42f3e7a20c9be2659f6ec44ecb04c227b6367794b03
Instruction Fuzzy Hash: 05115E75500304DFDB20CF55D844B96FBE4EF15720F0884AADD4A8B652D371E418DB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB3F6 Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 00DBB431

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 3655764b11df2b7bf4f0d03fc7511c6e33517b6ec6865870b6f95f200b600dcf
Instruction ID: 829baaa5a362484dfc744422ac3d752c4175d1065df6c761dbba2bea62bda929
Opcode Fuzzy Hash: 3655764b11df2b7bf4f0d03fc7511c6e33517b6ec6865870b6f95f200b600dcf
Instruction Fuzzy Hash: C0017C31400604DFDB208F45D884B61FBA0FF15724F08809ADD4A4A652D3B5E418DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0130125B Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421642559.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d73a4c2af1f289538effe2abd75512798b79b058da97cb6d8d111b50e2e1058
Instruction ID: 61e5e7de1955a9a7a5a104a3fa9eecfb588b9153fc1928764ec57e677e1284ae
Opcode Fuzzy Hash: 2d73a4c2af1f289538effe2abd75512798b79b058da97cb6d8d111b50e2e1058
Instruction Fuzzy Hash: 3751F430601211CFE726DF3AD8117AA37EAAF88398F184264D511EB6E5DB35D901CB20

Uniqueness

Uniqueness Score: -1.00%

Function 01300F90 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 01300FB7

Memory Dump Source

Source File: 00000000.00000002.4421642559.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_jpGSWjSTSw.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7c6ddd3be8bb004b2fb310062ec873b729c6481db5f26baa2fc47f37f2d6d22c
Instruction ID: a736dba5aa3ca1c06f9eb2379dda282a4e8ad5d1b60d2b506f1eac32847b77a0
Opcode Fuzzy Hash: 7c6ddd3be8bb004b2fb310062ec873b729c6481db5f26baa2fc47f37f2d6d22c
Instruction Fuzzy Hash: 074195317012118FCB15EF79C8946AE77E6EF84248B148479D909DB3D9DB39CD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01300F7F Relevance: 1.6, APIs: 1, Instructions: 109
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 01300FB7

Memory Dump Source

Source File: 00000000.00000002.4421642559.0000000001300000.00000040.00000800.00020000.00000000.sdmp, Offset: 01300000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1300000_jpGSWjSTSw.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 76a7added07a949b04dc47e83bb4682f08c20ef0504958a0fc03c81bbfb32525
Instruction ID: c8cd8d48d6d47a6671757b1208a9a0420c332a29104e2c3ce31da502ed7202c6
Opcode Fuzzy Hash: 76a7added07a949b04dc47e83bb4682f08c20ef0504958a0fc03c81bbfb32525
Instruction Fuzzy Hash: F24192317002128FCB15DF79C8946AAB7E6EF88204B148479D909DB3DAEB39CD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0135144A Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 0135152E

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 858414443744e4d4cffc73b636b562a8ce6f9b3dde765a9ebf5c423de9ad41b0
Instruction ID: 33180a3ff37734dde0850b35592345381bd4499121ce3ace91e44fcff1efc7e8
Opcode Fuzzy Hash: 858414443744e4d4cffc73b636b562a8ce6f9b3dde765a9ebf5c423de9ad41b0
Instruction Fuzzy Hash: BD417C6150E3C16FD3038B358C61AA2BFB4AF47214F0E85CBD8C4CF5A3D624A959C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBBDA2 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00DBBE61

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7d34d2e6d2524316e190a957a064415932e37a7406c2d49696e710e8c9af5d16
Instruction ID: 5a3bf89c4cb58a5a1f22d3e091eeec7a7b82132e7d7657ae07a436975181951e
Opcode Fuzzy Hash: 7d34d2e6d2524316e190a957a064415932e37a7406c2d49696e710e8c9af5d16
Instruction Fuzzy Hash: B331A271504380AFE722CF25DC44BA2BFE8EF16324F08849AE9858B252D375E809DB71

Uniqueness

Uniqueness Score: -1.00%

Function 013524F6 Relevance: 1.6, APIs: 1, Instructions: 99
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 013525BD

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9c531ebbbb89bff6b36ffac8c2ff8cf671f37da3564e63767119cc05b037f654
Instruction ID: 4205a94d3369d17d58150a12bb6b38539609ed55a77379685927c46c1a616984
Opcode Fuzzy Hash: 9c531ebbbb89bff6b36ffac8c2ff8cf671f37da3564e63767119cc05b037f654
Instruction Fuzzy Hash: C5315E72504344AFE7228B65CC44FA7FFFCEF19618F08899AE9859B652D324E508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01350387 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 0135044E

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: bdac9457a633a6a17618136e5bd0bc97cd20aacac9e8099bedbafdc164a40607
Instruction ID: 3d52ab3c153b3f3802a3759206690fba9f5ae7e9a335e725c65daed2b4694c59
Opcode Fuzzy Hash: bdac9457a633a6a17618136e5bd0bc97cd20aacac9e8099bedbafdc164a40607
Instruction Fuzzy Hash: CF318F6110E3C06FD3138B258C65A61BFB4EF47614B0E45CBD884CB6A3D219A909D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 013511BC Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 01351283

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 51ba2fc0cdb559c817ffc6889e25b9e184c75ffc77d831dfff38bb2a43810530
Instruction ID: ea24218dcee8c4c3f1e5ba5e444e76aa30cf9dd7c64ce5f469e214df7c84dd7c
Opcode Fuzzy Hash: 51ba2fc0cdb559c817ffc6889e25b9e184c75ffc77d831dfff38bb2a43810530
Instruction Fuzzy Hash: 633191B1504344AFEB21CB61CD44FA6FBACEF44714F04889AFA489B692D375E948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0135103C Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessTimes.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 013510D9

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: dfd5c8577b34f39078ab46442265b9aea1bdd7a59f4119eb6215d02c02e2ca3a
Instruction ID: cce68b3682b45dd86d9f1f91f8c5db9b6961255f917081b0a838e27e227bf3f0
Opcode Fuzzy Hash: dfd5c8577b34f39078ab46442265b9aea1bdd7a59f4119eb6215d02c02e2ca3a
Instruction Fuzzy Hash: E031D6725097805FD7628F25DC44F96BFB8EF16724F0884DAE9858F193D321A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 00DBAA52 Relevance: 1.6, APIs: 1, Instructions: 91
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 00DBAB05

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a4b281d5b086db884c7f88f3413a45e0ca9bd2a70cbb5abc253407c42eeaff78
Instruction ID: 951e641efd5e87c2a1ef55ad35605aed1f384f0060313d3129cb8a0916934664
Opcode Fuzzy Hash: a4b281d5b086db884c7f88f3413a45e0ca9bd2a70cbb5abc253407c42eeaff78
Instruction Fuzzy Hash: CE317372409384AFE7228B65CC44FA7BFBCEF16714F08859AE9858B553D225E90CC772

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00DBA6B9

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: c51c1d8d55991302a077b1700fd542ecae289bd9ad148adb9adabba51bf92bc7
Instruction ID: ee9e7749d4d810cddd9f8efaaf5b5d269df619787fe10252c24f9ea69f204b38
Opcode Fuzzy Hash: c51c1d8d55991302a077b1700fd542ecae289bd9ad148adb9adabba51bf92bc7
Instruction Fuzzy Hash: 813190B1509380AFE722CB25CC45B96BFF8EF16314F08849AE9448B292D374E809C772

Uniqueness

Uniqueness Score: -1.00%

Function 01350938 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 013509CF

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 3dd7537b4b24c85a2c89a8b27d8e28c2c3b8638118a9847e25c7c43b7541ac44
Instruction ID: 6286c6248f65c89d935e8a697540528467e35e368eab8a9ade0cca2dbed434e3
Opcode Fuzzy Hash: 3dd7537b4b24c85a2c89a8b27d8e28c2c3b8638118a9847e25c7c43b7541ac44
Instruction Fuzzy Hash: 7B31A071505384AFE722CB24DC45FA7BBA8EF05714F08849AE945DB652D324E808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01352522 Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE(?,00000E24), ref: 013525BD

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 322fdeafd76f7959b691b2faad776a0946fbbb82878449a707ce7a1208dd3ac5
Instruction ID: 274d954dafbc38db1d2ad213855afdb7ee7f15ca8607079a533f6cdc36d40cff
Opcode Fuzzy Hash: 322fdeafd76f7959b691b2faad776a0946fbbb82878449a707ce7a1208dd3ac5
Instruction Fuzzy Hash: 93215E72500604EFEB619F15CD44FA7FBECEF18A18F04895AE94ADA652E730E508CA71

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 00DBA40C

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 69152c5e22f0e28bded8a53509320ab93d17b89efbeabf1455ffdee43b898d07
Instruction ID: 395e34b6541bde02a04e156e53bb308e1f08635ec6d2b893991d325719167066
Opcode Fuzzy Hash: 69152c5e22f0e28bded8a53509320ab93d17b89efbeabf1455ffdee43b898d07
Instruction Fuzzy Hash: BB317175505784AFE722CF15CC84F92BBF8EF16714F08849AE985CB292D364E909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 01352864 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 013528F8

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 349f595cf19d5ddf3a182d0b6e149e6bee28712e21ca4700dbb6ff025c25656a
Instruction ID: 167b903a9302c8f52c2c0fbaa66e56220577c58ad2d8d36e3c84bb8f113aeb36
Opcode Fuzzy Hash: 349f595cf19d5ddf3a182d0b6e149e6bee28712e21ca4700dbb6ff025c25656a
Instruction Fuzzy Hash: E521E4715093849FE713CB20CC54B96BFA8AF56728F0884DBE9488F293D224A809C762

Uniqueness

Uniqueness Score: -1.00%

Function 013511DE Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(?,00000E24), ref: 01351283

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 999acaca863ee966a8c27380c5b8784ceac41ff0765d01339e24e5046bc5227c
Instruction ID: a8db2f66ecdaea000fc1430682970a6256ab6ddb6d0ab32ab8e36ed5fba4b9e0
Opcode Fuzzy Hash: 999acaca863ee966a8c27380c5b8784ceac41ff0765d01339e24e5046bc5227c
Instruction Fuzzy Hash: EA219FB2500304AFEB319B60CD85FA6F7ACEF14718F04885AFA49DA681D775E548CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DBBEB8 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 00DBBF4D

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: c7ef268e5e55bc30dd617e16c0512b162a3b113b26341552bc31635439fcb34f
Instruction ID: 4b257e839459b0fe4c395cc2f7e5f7dec3ac80e68b732382d097399356b40438
Opcode Fuzzy Hash: c7ef268e5e55bc30dd617e16c0512b162a3b113b26341552bc31635439fcb34f
Instruction Fuzzy Hash: 06210A75409780AFE7138B21DC41BA2BFBCEF5B724F0981D6E9848B293D2649909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 01352795 Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 01352824

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 6ff1adfce052c2eeecbe28f4b2e8daae2083a87172aaae210e42b04ff863eb3e
Instruction ID: 2bc3ab8ac430c9c7a3d863e1fbfa416ac58cd825afb963bbadeb3567b4974d4c
Opcode Fuzzy Hash: 6ff1adfce052c2eeecbe28f4b2e8daae2083a87172aaae210e42b04ff863eb3e
Instruction Fuzzy Hash: 6B214A715093849FEB62CF65C844A52BFE8EF06614F0884DAED84CB163D224A809DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA462 Relevance: 1.6, APIs: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 00DBA4F8

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a0aafcfec6a78d8c08077ba58aa1d4cb67451edfb5a6805867fd6cb1b37640c8
Instruction ID: c778685854eace4b5b0d8233b76bc3f45aafb81d736aa9a5e3154918da6aba81
Opcode Fuzzy Hash: a0aafcfec6a78d8c08077ba58aa1d4cb67451edfb5a6805867fd6cb1b37640c8
Instruction Fuzzy Hash: A521B272504380AFD7228F15CC44FA7BFB8EF55710F08849AE985CB652D364E908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0135047A Relevance: 1.6, APIs: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 01350506

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 8acb7fbf8b6dbfdb6f227172a6df421794c2f58238f5d8cd8a108e62db3dbf18
Instruction ID: ce7aff01c24b3c3730628c8102deb7274c2ec84c8211265f5eab1741e6b0a9e5
Opcode Fuzzy Hash: 8acb7fbf8b6dbfdb6f227172a6df421794c2f58238f5d8cd8a108e62db3dbf18
Instruction Fuzzy Hash: 12218E71409380AFD7228F55CC45F96FBA8EF15314F04889EE9858B652D365E408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01350AEE Relevance: 1.6, APIs: 1, Instructions: 77fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 01350B82

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: d4280c2cea12ec056e3191873972a54710a4c74c20fa86690c60d6c25d7256f1
Instruction ID: b86a79699536526ca456b35f2e0592ee77ad4cc9fabe86b0daf66f8f95c97ddb
Opcode Fuzzy Hash: d4280c2cea12ec056e3191873972a54710a4c74c20fa86690c60d6c25d7256f1
Instruction Fuzzy Hash: DF21AD71405384AFE722CF15CC44F96FBF8EF19324F04849EE9848B252D365E508CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBBDE2 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00DBBE61

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 84931f89c8f5b766f7283e76eac98a36fff43abc9b60a15cdfdaeef180262403
Instruction ID: cd042edf25ad27a0c9c81386ef231916580b19e7735f5ff21251c0e15b5a1317
Opcode Fuzzy Hash: 84931f89c8f5b766f7283e76eac98a36fff43abc9b60a15cdfdaeef180262403
Instruction Fuzzy Hash: 32217171500204EFEB21CF65DD45B96FBE8EF18724F08845AEA458B651D371E408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0135095E Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(?,00000E24), ref: 013509CF

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: 49dcc5e41c67b073ff9d4f9edf335ef63616f307b52bd2359fe40da21e4f28e6
Instruction ID: 681c09c92bcc943d5722fcedf0222ec43729ff0ad5d3322392461779f644c65d
Opcode Fuzzy Hash: 49dcc5e41c67b073ff9d4f9edf335ef63616f307b52bd2359fe40da21e4f28e6
Instruction Fuzzy Hash: E821D072500204AFEB20DF24CC45FAABBACEF14714F04846AFD05CB652D331E4088A71

Uniqueness

Uniqueness Score: -1.00%

Function 01350852 Relevance: 1.6, APIs: 1, Instructions: 75registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 013508E4

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 9b264904c4f7a055ebddea5e40e5eb50d9682cd9b6e86f482ad9279e17562d75
Instruction ID: 005b5e6aa94f6583e147513b4001b88fa7962a805c72f9d85825269776510c58
Opcode Fuzzy Hash: 9b264904c4f7a055ebddea5e40e5eb50d9682cd9b6e86f482ad9279e17562d75
Instruction Fuzzy Hash: 7621AE72504344AFE722CF15CC44F96BFF8EF15714F08849AE9458B252C365E508CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBAA86 Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E24), ref: 00DBAB05

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d59a794b09155dcd9b050d55be6df60850becb981ed3882eeb18e52ace56a140
Instruction ID: d7c453041d0b67997b92e18227f969bd3f3029391bffdb4a584f81eb683f545d
Opcode Fuzzy Hash: d59a794b09155dcd9b050d55be6df60850becb981ed3882eeb18e52ace56a140
Instruction Fuzzy Hash: 1F21CF72500304AFEB219E15CD44FABFBECEF28714F08845AE9458B642D734E84CCAB2

Uniqueness

Uniqueness Score: -1.00%

Function 01352A3F Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 01352ABB

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 87efab436b24fb70e0c51c6ed134b97d7d9a8be25cddfb7b18859c51b39d98d9
Instruction ID: 539280ccd66111da60298b084baf87777e5f9025e00156e836ea3f5d417e5ace
Opcode Fuzzy Hash: 87efab436b24fb70e0c51c6ed134b97d7d9a8be25cddfb7b18859c51b39d98d9
Instruction Fuzzy Hash: 1C21C271509384AFDB22CF25CC44F97BFA8EF55724F08849AE944DB152D374E408CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0135295B Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 013529D7

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 87efab436b24fb70e0c51c6ed134b97d7d9a8be25cddfb7b18859c51b39d98d9
Instruction ID: b87705cbcf1f8b92532a57177a85ea6f45c5252591bd78928961e901d5cca25e
Opcode Fuzzy Hash: 87efab436b24fb70e0c51c6ed134b97d7d9a8be25cddfb7b18859c51b39d98d9
Instruction Fuzzy Hash: 9F21C5715053846FE722CB25CC44F97BFA8EF55724F08849AE944DB152D374E408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA646 Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 00DBA6B9

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 37a4d951e84b7641a2170e35a3daa07ffce49802b86659e0ce5b01a4d6df176f
Instruction ID: da9d20eb2c59a0421e0499029a3906af7cbb20fff62a6ebb0a20f7fcb2c6a54b
Opcode Fuzzy Hash: 37a4d951e84b7641a2170e35a3daa07ffce49802b86659e0ce5b01a4d6df176f
Instruction Fuzzy Hash: 1C2195B15042049FEB21DF25CD45B96FBE8EF14314F08846EE9498B741D775E805CA72

Uniqueness

Uniqueness Score: -1.00%

Function 01350D85 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 01350E08

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: f6b6d798d14edb1ad7dff041917cfd345b52391478f0e3a209b4ca5774546175
Instruction ID: d7afb831cb04b952e45e43a8920b2377fb1958e2b34e3da24f60d4bf6f86e3fb
Opcode Fuzzy Hash: f6b6d798d14edb1ad7dff041917cfd345b52391478f0e3a209b4ca5774546175
Instruction Fuzzy Hash: 472195B1409384AFD712CB14CC44F96BFB8EF56724F0884DAE9489F153C365A548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01350212 Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 01350291

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d2653bcb0a886a459a24f6aba0a1dc24848d0b5d63a1af61918c6c7286254def
Instruction ID: 07164b4217c0dc09970cd92ef4d2c120a7605862df171c0cca9780ef7733c2ea
Opcode Fuzzy Hash: d2653bcb0a886a459a24f6aba0a1dc24848d0b5d63a1af61918c6c7286254def
Instruction Fuzzy Hash: 13218E72405384AFDB22CF51DC44F96BFB8EF55724F08849AE9459B552C335A408CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 00DBA40C

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0cd26f33e039cc570cdc0c9d1139bd382aacde7995405a6a50db4cd48b7b0c86
Instruction ID: d29aba25ec5878c317b630e6c1a6ce393f37d13d02f6da0dcabcf8ba91fbbb44
Opcode Fuzzy Hash: 0cd26f33e039cc570cdc0c9d1139bd382aacde7995405a6a50db4cd48b7b0c86
Instruction Fuzzy Hash: 23218E75600204AFEB21CE55CC84FA6B7ECEF28714F08845AE94ACB751D7A0E809CA72

Uniqueness

Uniqueness Score: -1.00%

Function 013526CF Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 0135274B

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 9b54b4eba80aa60174c0debb610f4643110e02884b568bdf693d43e4daa5c061
Instruction ID: 3fbb2086a42b456b14f2f9fed2a3028c89adc89018f5c1af121bb37c3b7f72c8
Opcode Fuzzy Hash: 9b54b4eba80aa60174c0debb610f4643110e02884b568bdf693d43e4daa5c061
Instruction Fuzzy Hash: D021A171409384AFDB22CF10CC44F97BFA8EF55714F08849AE9449B152C374E508CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB24C Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBB2B8

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b3594f0c64809d184ec32192497247427dbb258b3773ea8f44cc35cf88060ca6
Instruction ID: 6fb621c8ebdd714d6412f88deb363f7e2ec767c9032a9cbe2abc10bbe4d80063
Opcode Fuzzy Hash: b3594f0c64809d184ec32192497247427dbb258b3773ea8f44cc35cf88060ca6
Instruction Fuzzy Hash: A321A1729093C09FDB128B25DC54792BFB4AF07324F0D84DAEC858F663D264A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB301 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,54530968,00000000,?,?,?,?,?,?,?,?,6C973C58), ref: 00DBB372

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 26872518f8f0c438c752943c28338dc7d02395d6121a9023a7d64eb3dc9dc4cd
Instruction ID: 4891e06fb63c5ae54607396404ec2a1f89ba59732e459e0bbe05457276da0227
Opcode Fuzzy Hash: 26872518f8f0c438c752943c28338dc7d02395d6121a9023a7d64eb3dc9dc4cd
Instruction Fuzzy Hash: E12150715093849FDB52CB25DC45B96BFF4EF06320F0984EAE985CB263D364A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01350B0E Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 01350B82

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 7f035a62001f460645b45cc8bb2b1c02a7cdb3ca14dc14b5cf70abe83c5132e0
Instruction ID: ca0b9cbf6cb3ffc04492b1e026c0f2b6439c4efbf7d1ef1fc26fa265d6d3f264
Opcode Fuzzy Hash: 7f035a62001f460645b45cc8bb2b1c02a7cdb3ca14dc14b5cf70abe83c5132e0
Instruction Fuzzy Hash: B7219D71500204AFEB22CF15DC85F96FBE8EF28728F04845EE9898B651D376E508CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0135049A Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32(?,?,?,?,?), ref: 01350506

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: e04a4475c4a0663048b66a83a930db5b51a84e1aa4e075db2d5f8552f26b85ed
Instruction ID: f5c24b5df313be78e0796bc85fcc331862295a675584b1bd9ddf158d8615df83
Opcode Fuzzy Hash: e04a4475c4a0663048b66a83a930db5b51a84e1aa4e075db2d5f8552f26b85ed
Instruction Fuzzy Hash: 9F21BE71504204AFEB21CF55CD45F96FBE8EF18728F04885EED498A652D372E408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0135138E Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 0135140A

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: d49cffd694de65937d4a7455f84af81b6e4dd0925f8dbeaa2bca9ff5c91943f8
Instruction ID: 1088ee704bfcf1bcf4943e33345268a0f9a780fd180f1186a259e55612f9faf9
Opcode Fuzzy Hash: d49cffd694de65937d4a7455f84af81b6e4dd0925f8dbeaa2bca9ff5c91943f8
Instruction Fuzzy Hash: 9421BE71408380AFDB228F64CC44B52BFF4EF06610F0884DAED858B263D335A808DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA710 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBA780

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 84b9a1cce06d0963e60cd5c7e0c899e05a76416ca0a216530f1b02a0a22fe3d7
Instruction ID: 5218d55109b2626175091bb6d89d87f6741cda4497a942dec998984cd06928b2
Opcode Fuzzy Hash: 84b9a1cce06d0963e60cd5c7e0c899e05a76416ca0a216530f1b02a0a22fe3d7
Instruction Fuzzy Hash: 7D21D2B55083809FDB118F25DD85B92BFB8EF02324F0884EAED458B653D335A905DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0135174A Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 013517D3

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b6cc95625c7070d4917860ac3b40fccb294f5a46c13c6ac171d2421e0ad783db
Instruction ID: c5346f69b2d5aa838515443059f3c5b9c0609971e223069253cfd6da8bf2cc4e
Opcode Fuzzy Hash: b6cc95625c7070d4917860ac3b40fccb294f5a46c13c6ac171d2421e0ad783db
Instruction Fuzzy Hash: EB11E4714043446FE722CB11CC85FA6FFA8DF45724F08809AF9449B292D264E948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA486 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 00DBA4F8

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: b319fe2d9a8206258d4253fbe5097c549b8cb5def17d433af4aeb3c938fab92c
Instruction ID: 17c039f57615131d8ba9c2a1b39e65042a9195849adab94ef3c65e17fe25ff46
Opcode Fuzzy Hash: b319fe2d9a8206258d4253fbe5097c549b8cb5def17d433af4aeb3c938fab92c
Instruction Fuzzy Hash: 1111B172500300AFEB318E15CC45FA7BBECEF24714F08845AED4A8A641D760E908CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 01350872 Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 013508E4

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d333be23f2623a8d2526764e021acba5df43248b7495bfc2e03edef9bd20e1b4
Instruction ID: 9734713275b1d678b35c2b8a5e949c64f99ad00b25907db5fee9ed5b84062d15
Opcode Fuzzy Hash: d333be23f2623a8d2526764e021acba5df43248b7495bfc2e03edef9bd20e1b4
Instruction Fuzzy Hash: 2E11AF72500304AFEB71CE55CC44FA6BBECEF28B24F04845AED459B652D761E508CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB014 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00DBB07E

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 273b98df012de5ff59653f5e6b26ae9c6d8e99343b7b0e1c15da73f09b37493d
Instruction ID: edfca800f552533d7f56f4c1a6113a9c96dce3ab4549b6701310a010980dfb56
Opcode Fuzzy Hash: 273b98df012de5ff59653f5e6b26ae9c6d8e99343b7b0e1c15da73f09b37493d
Instruction Fuzzy Hash: 8A115E715053809FDB21CF25DC85BA7BFE8EF16220F0884AAE945CB652D364E804CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0135107A Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 013510D9

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: d898694d3cc64da004c3f2bea4cf12c87935fff7fb6af7fcdc386ba106ce6005
Instruction ID: 1fe4e6fac111ef7ea2e6a1738a5027703d136dd11514fbf1af7e0845c0fa87f0
Opcode Fuzzy Hash: d898694d3cc64da004c3f2bea4cf12c87935fff7fb6af7fcdc386ba106ce6005
Instruction Fuzzy Hash: 1C11D372600204AFEB618F55DC45FA6FBA8EF24724F04846AED058B651D770E408CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0135297E Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetProcessWorkingSetSize.KERNEL32(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 013529D7

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 1490e71c96034b8a5b5386ee2c6feb52ab02c3c8fda7da9ec8a1a668c48b2c28
Instruction ID: 11a0e7c3e8a388722f0a2d4e66afd2e884184acec86ba5ff6922b1851f4d5640
Opcode Fuzzy Hash: 1490e71c96034b8a5b5386ee2c6feb52ab02c3c8fda7da9ec8a1a668c48b2c28
Instruction Fuzzy Hash: 1011C472500204AFEB61CF15DC45FABB7ACEF25728F04846AED09DB641D774E408CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 01352A62 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetProcessWorkingSetSize.KERNEL32(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 01352ABB

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: ProcessSizeWorking
String ID:
API String ID: 3584180929-0
Opcode ID: 1490e71c96034b8a5b5386ee2c6feb52ab02c3c8fda7da9ec8a1a668c48b2c28
Instruction ID: 8638d86ba015c7083aedc2b23a49d38abfb515423a5f3b94456109a8da7bdccb
Opcode Fuzzy Hash: 1490e71c96034b8a5b5386ee2c6feb52ab02c3c8fda7da9ec8a1a668c48b2c28
Instruction Fuzzy Hash: 3C11B271504204AFEB62CF15DC45FA7B7ACEF24728F04846AED09CB641D774E408CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB507 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00DBB572

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8cc9b8cba50304d7d62c7c2bb17d753b6a23eb77b484a1518502982b5cd64aa1
Instruction ID: 399ed3731e79175bf810bf50726b5bd832c2e212aef071ac8702e2e00be46aa8
Opcode Fuzzy Hash: 8cc9b8cba50304d7d62c7c2bb17d753b6a23eb77b484a1518502982b5cd64aa1
Instruction Fuzzy Hash: B9117271409380AFDB228F55DC44A62FFF4EF4A320F0884DAED858B562C375A418DB72

Uniqueness

Uniqueness Score: -1.00%

Function 013528A2 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 013528F8

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: CodeExitProcess
String ID:
API String ID: 3861947596-0
Opcode ID: 03a68d19c0b368fb811193626114e105d204b27c4c0b00646b927dc961436708
Instruction ID: 8eafcb123e0829fbe4855e5cd70e376252cc580ed1fe71ad69d6e64758d8e5d7
Opcode Fuzzy Hash: 03a68d19c0b368fb811193626114e105d204b27c4c0b00646b927dc961436708
Instruction Fuzzy Hash: F8118F71500204AFEB618B15DC85FAABBACEF25728F0484AAED09CB641D774E5088AB1

Uniqueness

Uniqueness Score: -1.00%

Function 01350232 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 01350291

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: cfbf92fb95c0317c2ae2c43007c794ef5788961c2844bae3818d0425baede84d
Instruction ID: de0d1f093fb30bb7180eeadd3269f341ca582928f0c4c1edb88e51fa19eb4d3a
Opcode Fuzzy Hash: cfbf92fb95c0317c2ae2c43007c794ef5788961c2844bae3818d0425baede84d
Instruction Fuzzy Hash: EF11B272500204AFEB62CF55DC44FA6FBA8EF24728F04845AED499B651C775E408CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 013526F2 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 0135274B

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: ioctlsocket
String ID:
API String ID: 3577187118-0
Opcode ID: 4aa5116a784884dd8549a32f2cc8b37f3ee0611beac85820b7c3818598a17ecf
Instruction ID: b5fe998f41c208e32c9703daf9641f040f9440b16cf3e53e13e4d49e00d71d43
Opcode Fuzzy Hash: 4aa5116a784884dd8549a32f2cc8b37f3ee0611beac85820b7c3818598a17ecf
Instruction Fuzzy Hash: B211A371500204AFEB61CF55DC45FA7FBACEF24728F04849AED499B642D774E408CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA9B5 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBAA14

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ec3c8acc3601c9edda0a3bdaef60b1a02e73bb7c2d35d26a87fb329a70889547
Instruction ID: 8bbf4bd9bf2f2b198b7d04633dd9f5aec99d699e5ded5a56d0957561f2454df7
Opcode Fuzzy Hash: ec3c8acc3601c9edda0a3bdaef60b1a02e73bb7c2d35d26a87fb329a70889547
Instruction Fuzzy Hash: 101160715093C09FDB128B25DC44A92BFB4EF47220F0884DAED858F153C275A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01350DB2 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 01350E08

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: d27ee7fed9feb0658bf2098f07ec735224c49ad54e97013d670e502af4aeb1ac
Instruction ID: 44376fd908edd12e8f88844df46a5127df9f59825b787bc54c32f62c1d2248b5
Opcode Fuzzy Hash: d27ee7fed9feb0658bf2098f07ec735224c49ad54e97013d670e502af4aeb1ac
Instruction Fuzzy Hash: ED11C271500204AFEB61CF15DC45FA6FBECEF24B28F14849AED089B642D775E408CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA2D2 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00DBA330

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8ea058f1629e27c3d0fadc5956c9a15c13bfc02a074be629fdeef47e7ced06b1
Instruction ID: dde617f3ad8548ed75f880e501c020acb81c372348091c683be89e3d73b8dc2d
Opcode Fuzzy Hash: 8ea058f1629e27c3d0fadc5956c9a15c13bfc02a074be629fdeef47e7ced06b1
Instruction Fuzzy Hash: 041182714093C0AFDB228B15DC54A62BFB4DF47624F0C80CBED858B263C265A908D772

Uniqueness

Uniqueness Score: -1.00%

Function 0135176A Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E24), ref: 013517D3

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7cd4f714bd0de352521aadbcbdba931499363b0052cd4c49f14878aadd4a8ce5
Instruction ID: 61d06fbe345cf9b2194e8bb356346287af8bc6635de8afa57e106bf6f7fd3f26
Opcode Fuzzy Hash: 7cd4f714bd0de352521aadbcbdba931499363b0052cd4c49f14878aadd4a8ce5
Instruction Fuzzy Hash: B811E571500304AFEB719B15DD45FA6FBE8DF14B28F14809AED485A781D3B4E548CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 013527CE Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

select.WS2_32(?,?,?,?,?), ref: 01352824

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 3f0c4076171c751eceac23331726f69b53626d0bb749ccb075e155eb107536dc
Instruction ID: 0e6b139735107fd027374539b5113d233b6af5bf474c62a14c1a69e64f1a1045
Opcode Fuzzy Hash: 3f0c4076171c751eceac23331726f69b53626d0bb749ccb075e155eb107536dc
Instruction Fuzzy Hash: 5B112875600244DFEB60CF69D884F52FBE8EF14A14F0884AAED49CB652D334E448CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA078 Relevance: 1.6, APIs: 1, Instructions: 54networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00DBA0D5

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 908b5b2951a738743bd81f311fc183572d08999e3ba28ea113ea82906ec7db28
Instruction ID: 1701768bb877c25bb8ac355322bc4bd745e9f41f40a582bb417262ddf8c6803c
Opcode Fuzzy Hash: 908b5b2951a738743bd81f311fc183572d08999e3ba28ea113ea82906ec7db28
Instruction Fuzzy Hash: B4116D71509380AFDB62CF15DC44B52FFB4EF46224F08849EED858B552C275A818DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB036 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 00DBB07E

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c02d3106558d19efdcd6d79375fb580e842ad85a1acb29f0f29532b4ffdc699f
Instruction ID: 72608e379e119152dab7d1602c00edd65bfe8bd9a84449d8e19d09f75b9c3ebe
Opcode Fuzzy Hash: c02d3106558d19efdcd6d79375fb580e842ad85a1acb29f0f29532b4ffdc699f
Instruction Fuzzy Hash: 9D115E71600200CFDB60DF29D845BA6BBD8EF15320F0884AADD4ACB652D774E804CA71

Uniqueness

Uniqueness Score: -1.00%

Function 00DBBEFA Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E24,54530968,00000000,00000000,00000000,00000000), ref: 00DBBF4D

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 6f783c2287a0d5cbe1c49f925363336617532eaa54efeee1000b8e51fc0b7f33
Instruction ID: d2f32e0b168a0beb486e3cee82dc73e324aca17aded24273acdaac3b34be4442
Opcode Fuzzy Hash: 6f783c2287a0d5cbe1c49f925363336617532eaa54efeee1000b8e51fc0b7f33
Instruction Fuzzy Hash: 1C01C071504204EFEB218B01DC85BA6BBA8DF28724F18C096ED098B741D7B5E908CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA918 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 00DBA96F

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: 4d8446c8348db9387762888e449e1225e35da84377919167f5f7f370d72fe168
Instruction ID: 0e2d37e2791d83c4cb5f2b6d6ac8d960b87855e920fd2342c30e23cf27510bd4
Opcode Fuzzy Hash: 4d8446c8348db9387762888e449e1225e35da84377919167f5f7f370d72fe168
Instruction Fuzzy Hash: 49117071509384AFDB21CF65DC84B52FFA4EF46320F0984DAED858F262D275A808DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB332 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

K32EnumProcesses.KERNEL32(?,?,?,54530968,00000000,?,?,?,?,?,?,?,?,6C973C58), ref: 00DBB372

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: EnumProcesses
String ID:
API String ID: 84517404-0
Opcode ID: 23fc41a6c495156443d45da0f85e6f9b98fcde98ac5a802830cb00dbfede6cc7
Instruction ID: ddf1e5edae552ae420a1b91e328b871c43679033b2e2449842c212b2ce2c65fe
Opcode Fuzzy Hash: 23fc41a6c495156443d45da0f85e6f9b98fcde98ac5a802830cb00dbfede6cc7
Instruction Fuzzy Hash: 75115B71604204DFDB60CF65D885B96FBE8EF15320F0884AADD4A8B752D3B5E808DB72

Uniqueness

Uniqueness Score: -1.00%

Function 013513BE Relevance: 1.5, APIs: 1, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSAConnect.WS2_32(?,?,?,?,?,?,?), ref: 0135140A

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: Connect
String ID:
API String ID: 3144859779-0
Opcode ID: 0ddfc85968cf89fba4109d333e07fc25abcf29b56a5437144d3d2e827d1d8e3c
Instruction ID: 6ac584363cb750c7cbe57a601c86751efa87fd5c4c82617ca7b47e4842929681
Opcode Fuzzy Hash: 0ddfc85968cf89fba4109d333e07fc25abcf29b56a5437144d3d2e827d1d8e3c
Instruction Fuzzy Hash: D9115A715002049FDB61CF55D844F52FBF4EF08624F0889AADE498B622D375E458DB62

Uniqueness

Uniqueness Score: -1.00%

Function 013514DE Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetVolumeInformationA.KERNELBASE(?,00000E24,?,?), ref: 0135152E

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 4ca6ff6da02bb99ede9bbb447ed9397a5e9ed38cfaa699a7825f4f5089a8f7f3
Instruction ID: d2d6378797a25c70d9ac1a3e61210a8374b9c9679f74d020e91bf89033ae0368
Opcode Fuzzy Hash: 4ca6ff6da02bb99ede9bbb447ed9397a5e9ed38cfaa699a7825f4f5089a8f7f3
Instruction Fuzzy Hash: 6D019E71600204ABD310DF16CC45B66FBA8EF88A24F14815AED089B742D731F915CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB52E Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00DBB572

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fff3eb59f2b3509a0e2f3b6d78e3e78bf1e93eeefc73054d52afb0ec779d6589
Instruction ID: 9ccdf1db1244312ba2df958ff85a7719069e32a005deeaf163a24263cd64df50
Opcode Fuzzy Hash: fff3eb59f2b3509a0e2f3b6d78e3e78bf1e93eeefc73054d52afb0ec779d6589
Instruction Fuzzy Hash: B7015B32900640DFDB31CF55D944B56FBE4EF18720F08899ADE8A4A652C375E418DF62

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA74E Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBA780

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: fc015bb4b8229cf1a407cc6b422751eb847408efd4a48cf380d525784d4950fd
Instruction ID: 7cdc87c8b44a8af0205b343a3d1d2fdb4fea153ef8ac28ed54b0c337eab4669a
Opcode Fuzzy Hash: fc015bb4b8229cf1a407cc6b422751eb847408efd4a48cf380d525784d4950fd
Instruction Fuzzy Hash: 3601B171504200DFDB108F19D885796FBA4DF11320F08C4ABDD4A8B742D774E804CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBB286 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBB2B8

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6e36209c224cf140a5566bed11a1c6eb32112391b444c26369a8d100446b08ae
Instruction ID: 81e859b2959c34616d07da85c7356c107be461e499d8f9abd8b7b1fc1ebb99af
Opcode Fuzzy Hash: 6e36209c224cf140a5566bed11a1c6eb32112391b444c26369a8d100446b08ae
Instruction Fuzzy Hash: 4201B171904240CFDB60CF1AD884796BBE4EF15320F08C0ABDD4A8B642C3B4E408CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 013503FE Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E24,?,?), ref: 0135044E

Memory Dump Source

Source File: 00000000.00000002.4421700164.0000000001350000.00000040.00000800.00020000.00000000.sdmp, Offset: 01350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1350000_jpGSWjSTSw.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 1048d62ff1af12a41331e77cb9abc3b958596d76a566cee11b4c88f2668466c6
Instruction ID: 79a3c83a01f041ecab126224a77a9fd88b80a1e369c4a2527b01052ab4bc9ad2
Opcode Fuzzy Hash: 1048d62ff1af12a41331e77cb9abc3b958596d76a566cee11b4c88f2668466c6
Instruction Fuzzy Hash: 1601A271540204ABD310DF16CC46B66FBE8FF98A24F14815AED089BB42D771F915CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA09A Relevance: 1.5, APIs: 1, Instructions: 42networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,?,?), ref: 00DBA0D5

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 671b766e3f6bf09574b6225264e7567fc4c15ed3ecf766e6e3ff3687ab211fdf
Instruction ID: 0b06585a542e8317ab8f732c82fe589e3307ccd9ba02a35463c637b6ebf3790f
Opcode Fuzzy Hash: 671b766e3f6bf09574b6225264e7567fc4c15ed3ecf766e6e3ff3687ab211fdf
Instruction Fuzzy Hash: DE019E31900340DFDB60DF59D844B92FBE4EF14324F08849ADD4A8B656D375E408DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA93A Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 00DBA96F

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: a8c7845d42ac34a80ca63f97f6bdf3a7004730eb037c13373aa8ebf52641a971
Instruction ID: 51388c620c4158c7c6f58061d2551b24ff4685772db8e8a17425add2d4566be9
Opcode Fuzzy Hash: a8c7845d42ac34a80ca63f97f6bdf3a7004730eb037c13373aa8ebf52641a971
Instruction Fuzzy Hash: 9B015A71904244DFDF208F19D884BA5FBA4EF15324F0884AADD498B256D375E408DEB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA9E2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00DBAA14

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 6558542fd6c69493cc0b20ea01661ecb53186dd4dec1caaa39fdbbf6cb9abce3
Instruction ID: 6105d8e924d3f44d89790f1c26287ce32b46b8fea8488c2e2637ec2f443886b7
Opcode Fuzzy Hash: 6558542fd6c69493cc0b20ea01661ecb53186dd4dec1caaa39fdbbf6cb9abce3
Instruction Fuzzy Hash: C7018B71904244DFDB20CF19D984BA2FBE4EF15724F08C4AADD4A8F242D379E408CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DBA2FE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00DBA330

Memory Dump Source

Source File: 00000000.00000002.4421165854.0000000000DBA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DBA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dba000_jpGSWjSTSw.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8b32f4dabd60256845f85bf2e40b4d8fa89760090ea02ebb9b5e74243133b13f
Instruction ID: f4bd547598c0fad3bbb5356863252bf4a5c8952827daa8316e0cd26622bdf1ed
Opcode Fuzzy Hash: 8b32f4dabd60256845f85bf2e40b4d8fa89760090ea02ebb9b5e74243133b13f
Instruction Fuzzy Hash: 3DF08C35904244DFDB208F09D885BA1FBE4EF15724F08C09ADD4A4B752D375E808DAB2

Uniqueness

Uniqueness Score: -1.00%

Function 057E22B8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4423109281.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57e0000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee10e04c7d1ba55ff48eb9bf60b1bd340ed765937e98e84c7729a2272b459082
Instruction ID: 3fb833f26191194e584ca3a07572543767303d42ab59c681ec7382bc1085a7b0
Opcode Fuzzy Hash: ee10e04c7d1ba55ff48eb9bf60b1bd340ed765937e98e84c7729a2272b459082
Instruction Fuzzy Hash: 8711D6B5908301AFD350CF19D880A5BFBE4FB98664F04896EF998D7311D231E918CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 01340814 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421686293.0000000001340000.00000040.00000020.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd65aeee35246a71926fdcbf66af3343f9efaab0f9fa8da061315303d6fb62b4
Instruction ID: fdbda1d7aade760b6bee367dd81eee2328e42e5e687fdbdce854d5fe184426e0
Opcode Fuzzy Hash: dd65aeee35246a71926fdcbf66af3343f9efaab0f9fa8da061315303d6fb62b4
Instruction Fuzzy Hash: 6411B4317042849FE719CB14DA40BA5BBE5EB8970CF24C9ACF6491BB53C777E806CA91

Uniqueness

Uniqueness Score: -1.00%

Function 013407E7 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421686293.0000000001340000.00000040.00000020.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e444b5389b6118f21511dc43464e582557fd297c60a9a00898ceed23a1afbb
Instruction ID: e9c6213121d80841b15482553ad9686b43d9dba33a0ce8eeab4ab8ab2ae55fb2
Opcode Fuzzy Hash: 38e444b5389b6118f21511dc43464e582557fd297c60a9a00898ceed23a1afbb
Instruction Fuzzy Hash: BF216D316493C09FD7178B10C990B51BFB2AF46618F2985DED4899B6A3C33A9807CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00DCB444 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421207597.0000000000DCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dca000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2b76cbebd092667eea73e891e72dda9eda3ea9b3d8a1c7e8ec529aaf38c56b9
Instruction ID: b96eab43cd62dfdac88a76b70bca359a2163b703a91aaecb858b4c4bb6e4e5c6
Opcode Fuzzy Hash: d2b76cbebd092667eea73e891e72dda9eda3ea9b3d8a1c7e8ec529aaf38c56b9
Instruction Fuzzy Hash: 6411E8B5908301AFD750CF09D840A5BFBE8EB98660F04891EF95997311D231E908CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 013405DF Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421686293.0000000001340000.00000040.00000020.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609961b53b470ddb1680de7463375c84493008f6927301ed3a9e96702e497be4
Instruction ID: ee13bf5d4f562877aee5177c2efa3f471501dff48209e6a9524ac0471956f288
Opcode Fuzzy Hash: 609961b53b470ddb1680de7463375c84493008f6927301ed3a9e96702e497be4
Instruction Fuzzy Hash: B701D1B65093806FD7118F06AC40862FFE8EF8662070884AFEC49CB652D225E808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 013408D0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421686293.0000000001340000.00000040.00000020.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c1c67aaa2b23e3d63c421edb1a30bdffb44cf47340dafd902acbb0d52c4d4a5
Instruction ID: 26bb5eaaafe2a12f9d9346f29c7d3b5323a80c8125255794c9df6f585f464655
Opcode Fuzzy Hash: 8c1c67aaa2b23e3d63c421edb1a30bdffb44cf47340dafd902acbb0d52c4d4a5
Instruction Fuzzy Hash: D2F0FB35208644DFC706CF04D680B55FBE2EB89718F24CAADE94917A52C737A812DA81

Uniqueness

Uniqueness Score: -1.00%

Function 01340606 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421686293.0000000001340000.00000040.00000020.00020000.00000000.sdmp, Offset: 01340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1340000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e1551bf3f8752fb66634de91af609c04de2cb2246ba38391b3cc4c802bd8ab
Instruction ID: 3491dba58a1d584c419db2ef26ef9f43a0879225d9d4ea5fc903f944e59b2dc1
Opcode Fuzzy Hash: e2e1551bf3f8752fb66634de91af609c04de2cb2246ba38391b3cc4c802bd8ab
Instruction Fuzzy Hash: CDE092B66017044B9750CF0AEC41452F7D8EB84A30708C47FDC0D8B701D239F508CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 057E2323 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4423109281.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57e0000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ee0be7d52c6c9162f3ebb03f661d07b986968a1c449caf4b69247a6a7d8fe06
Instruction ID: 082d5c313eaf475ff0f53f8256fb038aa723bc28d904b2bb957711b684ed55c1
Opcode Fuzzy Hash: 8ee0be7d52c6c9162f3ebb03f661d07b986968a1c449caf4b69247a6a7d8fe06
Instruction Fuzzy Hash: AEE0D8B254030467D7508E069C45F53FB98DB64931F04C567ED085B742D172B514CDF1

Uniqueness

Uniqueness Score: -1.00%

Function 057E1BCF Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4423109281.00000000057E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_57e0000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a4d1e73d8cb3824820a4202ad95470a5ed8e052457d37d5e7d4f424237037cc
Instruction ID: d14b0564be51b3e3c2a53f9a7350200597ed3c98608f442aacd412381fa1cb56
Opcode Fuzzy Hash: 6a4d1e73d8cb3824820a4202ad95470a5ed8e052457d37d5e7d4f424237037cc
Instruction Fuzzy Hash: D8E0D8B254030467D2509E069C45F53FB98DB50930F04C557ED095B702D172B514CDF1

Uniqueness

Uniqueness Score: -1.00%

Function 00DCB493 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421207597.0000000000DCA000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DCA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_dca000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53587902192cf8a88fca12f131ecfafbbe13763d8db719dda356e5f2ad880233
Instruction ID: 384ec868fc4334178f12177d2175bac7194b2874059da62d7a57c7680e4be929
Opcode Fuzzy Hash: 53587902192cf8a88fca12f131ecfafbbe13763d8db719dda356e5f2ad880233
Instruction Fuzzy Hash: ECE0DFB29403046BD2608E06AC46F63FB98DB60A31F08C56BEE095B702E272B514CEF1

Uniqueness

Uniqueness Score: -1.00%

Function 00DB23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421151742.0000000000DB2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db2000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3cce95849f3515aeb15897882ce7b2ce15a6f5c11d3e1d2c0578a6c8a88c324
Instruction ID: 590031ea73df0cf475c347acfa63c5c6a9206d20c700c080b70f7cb4b54aad8e
Opcode Fuzzy Hash: d3cce95849f3515aeb15897882ce7b2ce15a6f5c11d3e1d2c0578a6c8a88c324
Instruction Fuzzy Hash: 93D02E3A2006C08FD3168A0CC1A9BE93BD4AF61704F0A00F9A8008BB63C728D881C210

Uniqueness

Uniqueness Score: -1.00%

Function 00DB23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4421151742.0000000000DB2000.00000040.00000800.00020000.00000000.sdmp, Offset: 00DB2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_db2000_jpGSWjSTSw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f506e79cb0fdcbef0e4fbf7550e3513d515bc55c206707629fb9f98b0c05f33
Instruction ID: 62785bca7fd9cd9bee3175e3fcbfa7e0d2f0e3bcd05efaf44725ed09faa72121
Opcode Fuzzy Hash: 9f506e79cb0fdcbef0e4fbf7550e3513d515bc55c206707629fb9f98b0c05f33
Instruction Fuzzy Hash: 04D05E352002818BC715DA0CC6D4FA937D4AB54B14F0A44ECAC118B762C7B8D8C5CA10

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report jpGSWjSTSw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Njrat

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Windows Analysis Report
jpGSWjSTSw.exe

Function 01300F90 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Function 01300F7F Relevance: 1.6, APIs: 1, Instructions: 109
COMMON

Function 0135144A Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Function 00DBBDA2 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 013524F6 Relevance: 1.6, APIs: 1, Instructions: 99
registryCOMMON

Function 01350387 Relevance: 1.6, APIs: 1, Instructions: 98
registryCOMMON

Function 013511BC Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Function 0135103C Relevance: 1.6, APIs: 1, Instructions: 92
timeCOMMON

Function 00DBAA52 Relevance: 1.6, APIs: 1, Instructions: 91
registryCOMMON

Function 00DBA612 Relevance: 1.6, APIs: 1, Instructions: 89
synchronizationCOMMON

Function 01350938 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 01352522 Relevance: 1.6, APIs: 1, Instructions: 86
registryCOMMON

Function 00DBA361 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Function 01352864 Relevance: 1.6, APIs: 1, Instructions: 84
COMMON

Function 013511DE Relevance: 1.6, APIs: 1, Instructions: 84
COMMON