Play interactive tour

Edit tour

Analysis Report 7lrH3syQoO.exe

Overview

General Information

Sample Name:	7lrH3syQoO.exe
Analysis ID:	385220
MD5:	60c423711d537751bc90e037100aff0c
SHA1:	ed0afa5c41f18c5c61866f2e097acbd091190037
SHA256:	f57a18111a889d227696128ef7486897b7c35f2f81db4c6c930263786bbc2852
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM3

Yara detected Nanocore RAT

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

7lrH3syQoO.exe (PID: 5960 cmdline: 'C:\Users\user\Desktop\7lrH3syQoO.exe' MD5: 60C423711D537751BC90E037100AFF0C)

schtasks.exe (PID: 6172 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\YwKZCbS' /XML 'C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 6260 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "456436c5-01a8-4b34-818a-a78bd296", "Group": "Default", "Domain1": "uyeco.pw", "Domain2": "127.0.0.1", "Port": 59044, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Enable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.502485666.00000000029D1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.508407731.0000000005B30000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000006.00000002.508407731.0000000005B30000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
00000006.00000002.506658685.0000000003A31000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xa8045:$x1: NanoCore.ClientPluginHost 0xda865:$x1: NanoCore.ClientPluginHost 0xa8082:$x2: IClientNetworkHost 0xda8a2:$x2: IClientNetworkHost 0xabbb5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0xde3d5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xa7dad:$a: NanoCore 0xa7dbd:$a: NanoCore 0xa7ff1:$a: NanoCore 0xa8005:$a: NanoCore 0xa8045:$a: NanoCore 0xda5cd:$a: NanoCore 0xda5dd:$a: NanoCore 0xda811:$a: NanoCore 0xda825:$a: NanoCore 0xda865:$a: NanoCore 0xa7e0c:$b: ClientPlugin 0xa800e:$b: ClientPlugin 0xa804e:$b: ClientPlugin 0xda62c:$b: ClientPlugin 0xda82e:$b: ClientPlugin 0xda86e:$b: ClientPlugin 0xa7f33:$c: ProjectData 0xda753:$c: ProjectData 0x1cbaee:$c: ProjectData 0x25650e:$c: ProjectData 0xa893a:$d: DESCrypto
00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: RegSvcs.exe PID: 6260	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4407f:$x1: NanoCore.ClientPluginHost 0x870d3:$x1: NanoCore.ClientPluginHost 0x14df40:$x1: NanoCore.ClientPluginHost 0x1a8e96:$x1: NanoCore.ClientPluginHost 0x20326e:$x1: NanoCore.ClientPluginHost 0x440a5:$x2: IClientNetworkHost 0x870f9:$x2: IClientNetworkHost 0x14df85:$x2: IClientNetworkHost 0x1a8ef7:$x2: IClientNetworkHost 0x2032b3:$x2: IClientNetworkHost 0x1ae2fc:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1bc26e:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegSvcs.exe PID: 6260	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 6260	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x31272:$a: NanoCore 0x312d9:$a: NanoCore 0x3137c:$a: NanoCore 0x43f71:$a: NanoCore 0x44012:$a: NanoCore 0x4407f:$a: NanoCore 0x44140:$a: NanoCore 0x45011:$a: NanoCore 0x45064:$a: NanoCore 0x4509d:$a: NanoCore 0x45110:$a: NanoCore 0x7de23:$a: NanoCore 0x7de48:$a: NanoCore 0x7de6e:$a: NanoCore 0x86fc5:$a: NanoCore 0x87066:$a: NanoCore 0x870d3:$a: NanoCore 0x87194:$a: NanoCore 0x88065:$a: NanoCore 0x880b8:$a: NanoCore 0x880f1:$a: NanoCore
Process Memory Space: 7lrH3syQoO.exe PID: 5960	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1a2fea:$x1: NanoCore.ClientPluginHost 0x1c1cf0:$x1: NanoCore.ClientPluginHost 0x1a304b:$x2: IClientNetworkHost 0x1c1d51:$x2: IClientNetworkHost 0x1a8450:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1b63c2:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1c7156:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1d50c8:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 7lrH3syQoO.exe PID: 5960	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 7lrH3syQoO.exe PID: 5960	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 7lrH3syQoO.exe PID: 5960	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1a2aef:$a: NanoCore 0x1a2b0b:$a: NanoCore 0x1a2c66:$a: NanoCore 0x1a2c75:$a: NanoCore 0x1a2f4e:$a: NanoCore 0x1a2f7a:$a: NanoCore 0x1a2fea:$a: NanoCore 0x1b2a2c:$a: NanoCore 0x1b2a3e:$a: NanoCore 0x1b2a7a:$a: NanoCore 0x1c17f5:$a: NanoCore 0x1c1811:$a: NanoCore 0x1c196c:$a: NanoCore 0x1c197b:$a: NanoCore 0x1c1c54:$a: NanoCore 0x1c1c80:$a: NanoCore 0x1c1cf0:$a: NanoCore 0x1d1732:$a: NanoCore 0x1d1744:$a: NanoCore 0x1d1780:$a: NanoCore 0x1a2b96:$b: ClientPlugin
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.RegSvcs.exe.5b30000.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
6.2.RegSvcs.exe.5b30000.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
6.2.RegSvcs.exe.5c60000.8.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
6.2.RegSvcs.exe.5c60000.8.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
6.2.RegSvcs.exe.5c60000.8.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.RegSvcs.exe.3a38a08.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
6.2.RegSvcs.exe.3a38a08.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
6.2.RegSvcs.exe.3a38a08.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.RegSvcs.exe.5c60000.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
6.2.RegSvcs.exe.5c60000.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
6.2.RegSvcs.exe.5c60000.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.RegSvcs.exe.3a38a08.3.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
6.2.RegSvcs.exe.3a38a08.3.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
6.2.RegSvcs.exe.3a38a08.3.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.RegSvcs.exe.5c64629.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
6.2.RegSvcs.exe.5c64629.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
6.2.RegSvcs.exe.5c64629.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.RegSvcs.exe.400000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
6.2.RegSvcs.exe.400000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
6.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.RegSvcs.exe.400000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x429ad:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x429ea:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4651d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x42715:$a: NanoCore 0x42725:$a: NanoCore 0x42959:$a: NanoCore 0x4296d:$a: NanoCore 0x429ad:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x42774:$b: ClientPlugin 0x42976:$b: ClientPlugin 0x429b6:$b: ClientPlugin 0x1007b:$c: ProjectData 0x4289b:$c: ProjectData 0x133c36:$c: ProjectData 0x1be656:$c: ProjectData 0x10a82:$d: DESCrypto
6.2.RegSvcs.exe.3a3d031.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
6.2.RegSvcs.exe.3a3d031.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
6.2.RegSvcs.exe.3a3d031.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
6.2.RegSvcs.exe.2a05f44.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
6.2.RegSvcs.exe.2a05f44.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
Click to see the 28 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 6260, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\YwKZCbS' /XML 'C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\YwKZCbS' /XML 'C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\7lrH3syQoO.exe' , ParentImage: C:\Users\user\Desktop\7lrH3syQoO.exe, ParentProcessId: 5960, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\YwKZCbS' /XML 'C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp', ProcessId: 6172

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000006.00000002.506658685.0000000003A31000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "456436c5-01a8-4b34-818a-a78bd296", "Group": "Default", "Domain1": "uyeco.pw", "Domain2": "127.0.0.1", "Port": 59044, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Enable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Multi AV Scanner detection for domain / URL

Show sources

Source: uyeco.pw

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\YwKZCbS.exe	Metadefender: Detection: 27%			Perma Link
Source: C:\Users\user\AppData\Roaming\YwKZCbS.exe	ReversingLabs: Detection: 58%

Multi AV Scanner detection for submitted file

Show sources

Source: 7lrH3syQoO.exe	Virustotal: Detection: 46%	Perma Link
Source: 7lrH3syQoO.exe	Metadefender: Detection: 27%	Perma Link
Source: 7lrH3syQoO.exe	ReversingLabs: Detection: 58%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000006.00000002.502485666.00000000029D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.506658685.0000000003A31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6260, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7lrH3syQoO.exe PID: 5960, type: MEMORY
Source: Yara match	File source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c60000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a38a08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c60000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a38a08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c64629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a3d031.2.raw.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\YwKZCbS.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: 7lrH3syQoO.exe

Joe Sandbox ML: detected

Source: 6.2.RegSvcs.exe.400000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 6.2.RegSvcs.exe.5c60000.8.unpack	Avira: Label: TR/NanoCore.fadte

Source: 7lrH3syQoO.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 7lrH3syQoO.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbMG source: RegSvcs.exe, 00000006.00000002.501144071.0000000000D6A000.00000004.00000020.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegSvcs.exe, 00000006.00000002.501176054.0000000000E8B000.00000004.00000001.sdmp
Source:	Binary string: (P9j0C:\Windows\mscorlib.pdb source: RegSvcs.exe, 00000006.00000002.501176054.0000000000E8B000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdb source: RegSvcs.exe, 00000006.00000003.447494278.000000000608F000.00000004.00000001.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdb source: RegSvcs.exe, 00000006.00000002.501176054.0000000000E8B000.00000004.00000001.sdmp
Source:	Binary string: $.pdb source: RegSvcs.exe, 00000006.00000002.501176054.0000000000E8B000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbki source: RegSvcs.exe, 00000006.00000002.500391488.0000000000CC3000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbcD source: RegSvcs.exe, 00000006.00000002.501144071.0000000000D6A000.00000004.00000020.sdmp
Source:	Binary string: Svcs.pdb source: RegSvcs.exe, 00000006.00000002.500391488.0000000000CC3000.00000004.00000020.sdmp

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0779E068
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	6_2_0613BC30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 4x nop then lea esp, dword ptr [ebp-04h]	6_2_0613BC40

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49717 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49721 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49722 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49723 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49725 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49726 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49729 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49732 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49733 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49734 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49736 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49737 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49738 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49741 -> 172.94.38.41:59044
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.5:49742 -> 172.94.38.41:59044

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: uyeco.pw
Source: Malware configuration extractor	URLs: 127.0.0.1

Source: unknown

DNS traffic detected: queries for: uyeco.pw

Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 7lrH3syQoO.exe	String found in binary or memory: http://gnu.org/licenses/gpl-3.0.txt
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 7lrH3syQoO.exe, 00000000.00000003.237792549.0000000005D60000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000003.244281911.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 7lrH3syQoO.exe, 00000000.00000003.244474317.0000000005D59000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers#
Source: 7lrH3syQoO.exe, 00000000.00000003.241884313.0000000005D60000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/;
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 7lrH3syQoO.exe, 00000000.00000003.244281911.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlr
Source: 7lrH3syQoO.exe, 00000000.00000003.241876644.0000000005D59000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/d
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: 7lrH3syQoO.exe, 00000000.00000003.243315622.0000000005D59000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmld
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 7lrH3syQoO.exe, 00000000.00000003.252571308.0000000005D59000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 7lrH3syQoO.exe, 00000000.00000003.244757324.0000000005D59000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersA
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 7lrH3syQoO.exe, 00000000.00000003.244557035.0000000005D59000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designerst
Source: 7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com=
Source: 7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF)r
Source: 7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF;r
Source: 7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comI.TTF
Source: 7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: 7lrH3syQoO.exe, 00000000.00000003.242222471.0000000005D2E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comaUre
Source: 7lrH3syQoO.exe, 00000000.00000003.245116208.0000000005D2E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalic
Source: 7lrH3syQoO.exe, 00000000.00000003.244281911.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comcomaUre
Source: 7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdCr
Source: 7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdeta
Source: 7lrH3syQoO.exe, 00000000.00000003.242222471.0000000005D2E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdiavfr
Source: 7lrH3syQoO.exe, 00000000.00000003.245116208.0000000005D2E000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdxr
Source: 7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comessedxr
Source: 7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comion
Source: 7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comlicqr
Source: 7lrH3syQoO.exe, 00000000.00000003.271362322.0000000005D20000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: 7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 7lrH3syQoO.exe, 00000000.00000003.237390730.0000000005D5C000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 7lrH3syQoO.exe, 00000000.00000003.237133863.0000000005D5A000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnw
Source: 7lrH3syQoO.exe, 00000000.00000003.247360018.0000000005D59000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: 7lrH3syQoO.exe, 00000000.00000003.247534513.0000000005D2E000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/Cr
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 7lrH3syQoO.exe, 00000000.00000003.247840153.0000000005D60000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/den
Source: 7lrH3syQoO.exe, 00000000.00000003.249180787.0000000005D37000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000003.247329878.0000000005D60000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 7lrH3syQoO.exe, 00000000.00000003.247534513.0000000005D2E000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/xr
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 7lrH3syQoO.exe, 00000000.00000003.238988379.0000000005D2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/)
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Cr
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Jrl
Source: 7lrH3syQoO.exe, 00000000.00000003.238988379.0000000005D2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Ure
Source: 7lrH3syQoO.exe, 00000000.00000003.239064536.0000000005D2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0ntCr
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/help
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/Ure
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/lM
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000003.238988379.0000000005D2D000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/nt
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/qr
Source: 7lrH3syQoO.exe, 00000000.00000003.239483333.0000000005D23000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/t
Source: 7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/tent
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 7lrH3syQoO.exe, 00000000.00000003.237484277.0000000005D2E000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: 7lrH3syQoO.exe, 00000000.00000003.245116208.0000000005D2E000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.de
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 7lrH3syQoO.exe	String found in binary or memory: https://dav.box.com/dav
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Source: RegSvcs.exe, 00000006.00000002.506658685.0000000003A31000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000006.00000002.502485666.00000000029D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.506658685.0000000003A31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6260, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7lrH3syQoO.exe PID: 5960, type: MEMORY
Source: Yara match	File source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c60000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a38a08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c60000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a38a08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c64629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a3d031.2.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000006.00000002.508407731.0000000005B30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegSvcs.exe PID: 6260, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegSvcs.exe PID: 6260, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 7lrH3syQoO.exe PID: 5960, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 7lrH3syQoO.exe PID: 5960, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.RegSvcs.exe.5b30000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.RegSvcs.exe.5c60000.8.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.RegSvcs.exe.3a38a08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.RegSvcs.exe.5c60000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.RegSvcs.exe.3a38a08.3.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.RegSvcs.exe.5c64629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 6.2.RegSvcs.exe.3a3d031.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 6.2.RegSvcs.exe.2a05f44.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07794610 NtQueryInformationProcess,		0_2_07794610
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07794609 NtQueryInformationProcess,		0_2_07794609

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_009B269C	0_2_009B269C
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07799FE0	0_2_07799FE0
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07793268	0_2_07793268
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07795DE8	0_2_07795DE8
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_0779ADE8	0_2_0779ADE8
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_0779BC68	0_2_0779BC68
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_0779E868	0_2_0779E868
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07790040	0_2_07790040
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07790C18	0_2_07790C18
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07790B63	0_2_07790B63
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07794708	0_2_07794708
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_077957E8	0_2_077957E8
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_077957E7	0_2_077957E7
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_077947A8	0_2_077947A8
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07794799	0_2_07794799
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07793B88	0_2_07793B88
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07793B85	0_2_07793B85
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07796E60	0_2_07796E60
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07793258	0_2_07793258
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07796E4F	0_2_07796E4F
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07793211	0_2_07793211
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07797D4F	0_2_07797D4F
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07793520	0_2_07793520
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07793510	0_2_07793510
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_077969B0	0_2_077969B0
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_077969A0	0_2_077969A0
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07795D9F	0_2_07795D9F
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07795D86	0_2_07795D86
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_0779B828	0_2_0779B828
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07790007	0_2_07790007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_028BE480	6_2_028BE480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_028BE471	6_2_028BE471
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_028BBBD4	6_2_028BBBD4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06130040	6_2_06130040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06138DC0	6_2_06138DC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0613D306	6_2_0613D306
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_06139A96	6_2_06139A96
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_061399D8	6_2_061399D8

Source: 7lrH3syQoO.exe	Binary or memory string: OriginalFilename vs 7lrH3syQoO.exe
Source: 7lrH3syQoO.exe, 00000000.00000002.282695361.000000000EB90000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs 7lrH3syQoO.exe
Source: 7lrH3syQoO.exe, 00000000.00000002.273137858.0000000002D5F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll2 vs 7lrH3syQoO.exe
Source: 7lrH3syQoO.exe, 00000000.00000000.232964393.00000000009B2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFieldAttributes.exe> vs 7lrH3syQoO.exe
Source: 7lrH3syQoO.exe, 00000000.00000002.282272621.000000000E145000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFieldA vs 7lrH3syQoO.exe
Source: 7lrH3syQoO.exe, 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll" vs 7lrH3syQoO.exe
Source: 7lrH3syQoO.exe, 00000000.00000002.281743375.00000000077E0000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs 7lrH3syQoO.exe
Source: 7lrH3syQoO.exe, 00000000.00000002.281743375.00000000077E0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs 7lrH3syQoO.exe
Source: 7lrH3syQoO.exe, 00000000.00000002.275081186.0000000004D30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs 7lrH3syQoO.exe
Source: 7lrH3syQoO.exe	Binary or memory string: OriginalFilenameFieldAttributes.exe> vs 7lrH3syQoO.exe

Source: 7lrH3syQoO.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000006.00000002.508407731.0000000005B30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.508407731.0000000005B30000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: RegSvcs.exe PID: 6260, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegSvcs.exe PID: 6260, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 7lrH3syQoO.exe PID: 5960, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 7lrH3syQoO.exe PID: 5960, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.RegSvcs.exe.5b30000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.RegSvcs.exe.5b30000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.RegSvcs.exe.5c60000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.RegSvcs.exe.5c60000.8.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.RegSvcs.exe.3a38a08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.RegSvcs.exe.3a38a08.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.RegSvcs.exe.5c60000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.RegSvcs.exe.5c60000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.RegSvcs.exe.3a38a08.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.RegSvcs.exe.3a38a08.3.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.RegSvcs.exe.5c64629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.RegSvcs.exe.5c64629.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 6.2.RegSvcs.exe.3a3d031.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.RegSvcs.exe.3a3d031.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 6.2.RegSvcs.exe.2a05f44.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 6.2.RegSvcs.exe.2a05f44.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: 7lrH3syQoO.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: YwKZCbS.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 6.2.RegSvcs.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 6.2.RegSvcs.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.RegSvcs.exe.400000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/6@15/1

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

File created: C:\Users\user\AppData\Roaming\YwKZCbS.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6180:120:WilError_01
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{456436c5-01a8-4b34-818a-a78bd296d065}

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

File created: C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp

Jump to behavior

Source: 7lrH3syQoO.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: Select * from UnmanagedMemoryStreamWrapper WHERE modelo=@modelo;?
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel5Erro ao listar Banco sql-UnmanagedMemoryStreamWrapper.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO UnmanagedMemoryStreamWrapper VALUES(@modelo, @fabricante, @ano, @cor);
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);

Source: 7lrH3syQoO.exe	Virustotal: Detection: 46%
Source: 7lrH3syQoO.exe	Metadefender: Detection: 27%
Source: 7lrH3syQoO.exe	ReversingLabs: Detection: 58%

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

File read: C:\Users\user\Desktop\7lrH3syQoO.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7lrH3syQoO.exe 'C:\Users\user\Desktop\7lrH3syQoO.exe'
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\YwKZCbS' /XML 'C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\YwKZCbS' /XML 'C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp'	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 7lrH3syQoO.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 7lrH3syQoO.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbMG source: RegSvcs.exe, 00000006.00000002.501144071.0000000000D6A000.00000004.00000020.sdmp
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: RegSvcs.exe, 00000006.00000002.501176054.0000000000E8B000.00000004.00000001.sdmp
Source:	Binary string: (P9j0C:\Windows\mscorlib.pdb source: RegSvcs.exe, 00000006.00000002.501176054.0000000000E8B000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdb source: RegSvcs.exe, 00000006.00000003.447494278.000000000608F000.00000004.00000001.sdmp
Source:	Binary string: symbols\dll\mscorlib.pdb source: RegSvcs.exe, 00000006.00000002.501176054.0000000000E8B000.00000004.00000001.sdmp
Source:	Binary string: $.pdb source: RegSvcs.exe, 00000006.00000002.501176054.0000000000E8B000.00000004.00000001.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbki source: RegSvcs.exe, 00000006.00000002.500391488.0000000000CC3000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbcD source: RegSvcs.exe, 00000006.00000002.501144071.0000000000D6A000.00000004.00000020.sdmp
Source:	Binary string: Svcs.pdb source: RegSvcs.exe, 00000006.00000002.500391488.0000000000CC3000.00000004.00000020.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 6.2.RegSvcs.exe.400000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.RegSvcs.exe.400000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_009BA578 push es; iretd	0_2_009BAD15
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Code function: 0_2_07790970 push ecx; retf	0_2_07790975
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0613C8DA push 8B000005h; retf	6_2_0613C8DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 6_2_0613BFD8 pushad ; ret	6_2_0613BFD9

Source: initial sample	Static PE information: section name: .text entropy: 7.79874403278
Source: initial sample	Static PE information: section name: .text entropy: 7.79874403278

Source: 6.2.RegSvcs.exe.400000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 6.2.RegSvcs.exe.400000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

File created: C:\Users\user\AppData\Roaming\YwKZCbS.exe

Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\YwKZCbS' /XML 'C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7lrH3syQoO.exe PID: 5960, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 6140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: foregroundWindowGot 826	Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe TID: 5924	Thread sleep time: -101938s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe TID: 3020	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Thread delayed: delay time: 101938	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000006.00000002.509413081.0000000006B40000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: RegSvcs.exe, 00000006.00000002.509413081.0000000006B40000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: RegSvcs.exe, 00000006.00000002.509413081.0000000006B40000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: 7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: RegSvcs.exe, 00000006.00000002.500842081.0000000000D37000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: RegSvcs.exe, 00000006.00000002.509413081.0000000006B40000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 420000	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 422000	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 9D7008	Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\YwKZCbS' /XML 'C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp'			Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe			Jump to behavior

Source: RegSvcs.exe, 00000006.00000002.502804778.0000000002AAE000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: RegSvcs.exe, 00000006.00000002.501338804.0000000001280000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegSvcs.exe, 00000006.00000002.501338804.0000000001280000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: RegSvcs.exe, 00000006.00000002.501338804.0000000001280000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: RegSvcs.exe, 00000006.00000002.509206452.000000000627D000.00000004.00000001.sdmp	Binary or memory string: Program Manager 4L
Source: RegSvcs.exe, 00000006.00000002.509357347.000000000677D000.00000004.00000001.sdmp	Binary or memory string: Program ManagerL
Source: RegSvcs.exe, 00000006.00000002.501338804.0000000001280000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: RegSvcs.exe, 00000006.00000002.501338804.0000000001280000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: RegSvcs.exe, 00000006.00000002.502637344.0000000002A2D000.00000004.00000001.sdmp	Binary or memory string: Program Managert

Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Users\user\Desktop\7lrH3syQoO.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\7lrH3syQoO.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\7lrH3syQoO.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000006.00000002.502485666.00000000029D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.506658685.0000000003A31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6260, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7lrH3syQoO.exe PID: 5960, type: MEMORY
Source: Yara match	File source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c60000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a38a08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c60000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a38a08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c64629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a3d031.2.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: 7lrH3syQoO.exe, 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe, 00000006.00000002.502485666.00000000029D1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe, 00000006.00000002.502485666.00000000029D1000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 00000006.00000002.502485666.00000000029D1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.506658685.0000000003A31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6260, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7lrH3syQoO.exe PID: 5960, type: MEMORY
Source: Yara match	File source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c60000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a38a08.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c60000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a38a08.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.5c64629.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.7lrH3syQoO.exe.3ea4eb8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.RegSvcs.exe.3a3d031.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection212	Masquerading1	Input Capture11	Security Software Discovery211	Remote Services	Input Capture11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Process Discovery2	Remote Desktop Protocol	Archive Collected Data11	Exfiltration Over Bluetooth	Remote Access Software1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion31	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection212	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	File and Directory Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	System Information Discovery12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information3	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing13	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7lrH3syQoO.exe	46%	Virustotal		Browse
7lrH3syQoO.exe	30%	Metadefender		Browse
7lrH3syQoO.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
7lrH3syQoO.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\YwKZCbS.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\YwKZCbS.exe	30%	Metadefender		Browse
C:\Users\user\AppData\Roaming\YwKZCbS.exe	58%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
6.2.RegSvcs.exe.400000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7		Download File
6.2.RegSvcs.exe.5c60000.8.unpack	100%	Avira	TR/NanoCore.fadte		Download File

Domains

Source	Detection	Scanner	Label	Link
uyeco.pw	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.fontbureau.comI.TTF	0%	URL Reputation	safe
http://www.fontbureau.comI.TTF	0%	URL Reputation	safe
http://www.fontbureau.comI.TTF	0%	URL Reputation	safe
http://www.fontbureau.comI.TTF	0%	URL Reputation	safe
http://www.fontbureau.comlicqr	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Cr	0%	Avira URL Cloud	safe
http://www.fontbureau.comdxr	0%	Avira URL Cloud	safe
http://www.fontbureau.comF;r	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Y0ntCr	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
uyeco.pw	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/help	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/qr	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fontbureau.comessedxr	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnw	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/den	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/)	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/)	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/)	0%	URL Reputation	safe
http://www.fontbureau.comaUre	0%	Avira URL Cloud	safe
http://www.fontbureau.comdeta	0%	Avira URL Cloud	safe
http://www.fontbureau.comdiavfr	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Ure	0%	Avira URL Cloud	safe
http://www.fontbureau.comdCr	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.com=	0%	Avira URL Cloud	safe
127.0.0.1	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/nt	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/tent	0%	Avira URL Cloud	safe
http://www.fontbureau.comcomaUre	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/xr	0%	Avira URL Cloud	safe
http://www.fontbureau.comion	0%	URL Reputation	safe
http://www.fontbureau.comion	0%	URL Reputation	safe
http://www.fontbureau.comion	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/lM	0%	Avira URL Cloud	safe
http://www.tiro.	0%	URL Reputation	safe
http://www.tiro.	0%	URL Reputation	safe
http://www.tiro.	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/t	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/t	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/t	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
uyeco.pw	172.94.38.41	true	true	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
uyeco.pw	true	Avira URL Cloud: safe	unknown
127.0.0.1	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designers/;	7lrH3syQoO.exe, 00000000.00000003.241884313.0000000005D60000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comI.TTF	7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comlicqr	7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designersA	7lrH3syQoO.exe, 00000000.00000003.244757324.0000000005D59000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/Cr	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	7lrH3syQoO.exe, 00000000.00000003.252571308.0000000005D59000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comdxr	7lrH3syQoO.exe, 00000000.00000003.245116208.0000000005D2E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comF;r	7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/Y0ntCr	7lrH3syQoO.exe, 00000000.00000003.239064536.0000000005D2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/help	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false		high
https://dav.box.com/dav	7lrH3syQoO.exe	false		high
http://www.goodfont.co.kr	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/qr	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	7lrH3syQoO.exe, 00000000.00000003.249180787.0000000005D37000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000003.247329878.0000000005D60000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comessedxr	7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnw	7lrH3syQoO.exe, 00000000.00000003.237133863.0000000005D5A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/den	7lrH3syQoO.exe, 00000000.00000003.247840153.0000000005D60000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://gnu.org/licenses/gpl-3.0.txt	7lrH3syQoO.exe	false		high
http://www.galapagosdesign.com/DPlease	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/)	7lrH3syQoO.exe, 00000000.00000003.238988379.0000000005D2D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comaUre	7lrH3syQoO.exe, 00000000.00000003.242222471.0000000005D2E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comdeta	7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comdiavfr	7lrH3syQoO.exe, 00000000.00000003.242222471.0000000005D2E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false		high
http://www.sandoll.co.kr	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.de	7lrH3syQoO.exe, 00000000.00000003.245116208.0000000005D2E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Ure	7lrH3syQoO.exe, 00000000.00000003.238988379.0000000005D2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	7lrH3syQoO.exe, 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comdCr	7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designerst	7lrH3syQoO.exe, 00000000.00000003.244557035.0000000005D59000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com=	7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	7lrH3syQoO.exe, 00000000.00000003.237792549.0000000005D60000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000003.244281911.0000000005D2F000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/	7lrH3syQoO.exe, 00000000.00000003.247360018.0000000005D59000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/nt	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000003.238988379.0000000005D2D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlr	7lrH3syQoO.exe, 00000000.00000003.244281911.0000000005D2F000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/tent	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.htmld	7lrH3syQoO.exe, 00000000.00000003.243315622.0000000005D59000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comcomaUre	7lrH3syQoO.exe, 00000000.00000003.244281911.0000000005D2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/xr	7lrH3syQoO.exe, 00000000.00000003.247534513.0000000005D2E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comion	7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/lM	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.	7lrH3syQoO.exe, 00000000.00000003.237484277.0000000005D2E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	7lrH3syQoO.exe, 00000000.00000003.237390730.0000000005D5C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false		high
http://www.founder.com.cn/cn	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp, 7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/t	7lrH3syQoO.exe, 00000000.00000003.239483333.0000000005D23000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comm	7lrH3syQoO.exe, 00000000.00000003.271362322.0000000005D20000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers#	7lrH3syQoO.exe, 00000000.00000003.244474317.0000000005D59000.00000004.00000001.sdmp	false		high
http://www.fontbureau.como	7lrH3syQoO.exe, 00000000.00000003.244908954.0000000005D2F000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/Cr	7lrH3syQoO.exe, 00000000.00000003.247534513.0000000005D2E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	7lrH3syQoO.exe, 00000000.00000002.279802834.0000000006F32000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comalic	7lrH3syQoO.exe, 00000000.00000003.245116208.0000000005D2E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/d	7lrH3syQoO.exe, 00000000.00000003.241876644.0000000005D59000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/Ure	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/Jrl	7lrH3syQoO.exe, 00000000.00000003.239841290.0000000005D2C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comF)r	7lrH3syQoO.exe, 00000000.00000003.243571139.0000000005D2F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.94.38.41	uyeco.pw	United States		209378	INIOS-ASFI	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	385220
Start date:	12.04.2021
Start time:	08:29:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	7lrH3syQoO.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/6@15/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.7% (good quality ratio 1.3%) Quality average: 53.2% Quality standard deviation: 36.3%
HCA Information:	Successful, ratio: 93% Number of executed functions: 57 Number of non-executed functions: 16
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 168.61.161.212, 104.43.139.144, 40.88.32.150, 23.210.248.85, 20.82.210.154, 2.20.142.209, 2.20.142.210, 20.50.102.62, 92.122.213.194, 92.122.213.247, 20.54.26.129 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcoleus15.cloudapp.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, fs.microsoft.com, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, a767.dscg3.akamai.net, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:30:27	API Interceptor	2x Sleep call for process: 7lrH3syQoO.exe modified
08:30:36	API Interceptor	882x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7lrH3syQoO.exe.log Download File
Process:	C:\Users\user\Desktop\7lrH3syQoO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp Download File
Process:	C:\Users\user\Desktop\7lrH3syQoO.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1644
Entropy (8bit):	5.17517889346709
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBGtn:cbhC7ZlNQF/rydbz9I3YODOLNdq3S
MD5:	FA4DBA4671B647E90B8DE5521E76989E
SHA1:	2467E3E2742EF64AE5FE76A40365463D47729C16
SHA-256:	A510BED32A4AAD1D8C964B9926AA173F0DBE9B6EFE602912935CE9DB875EBBD9
SHA-512:	F2B7A2924A351F47E6B1004C99C0050290BC981AD9B8943C9D7534D8654F2C6F453CBFAAE80BFF0B1FF359C2EBBD811D79E850C9FB90947335D99F75A4817891
Malicious:	true
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	3016
Entropy (8bit):	7.024371743172393
Encrypted:	false
SSDEEP:	48:Ik/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrwfk/lCrws:flC0IlC0IlC0IlC0IlC0IlC0IlC0IlCe
MD5:	1BD61AD9406ED789A9447AF5E4E1368C
SHA1:	10C211612AAFC0F9A3E5DD15A45EDC08E5D76038
SHA-256:	AD46B72200459E73CDEBC96C7A48468559D68DDC223627FBE4BCF93F32311F57
SHA-512:	79EF944DE5355166735808D59ABB8EB7AEF35BCFF537DD60783CAD75FC98FC9649D971C3A36A1566EA26B28FFAD57E9BC065BFF7D0B26E868AB2B2FC1DC39DBC
Malicious:	false
Reputation:	low
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.....@.3..{...grv+V...B.......].P...W.4C}uL.....s~..F...}......E......E...6E.....{...{.yS...7..".hK.!.x.2..i..zJ... ....f..?._....0.:e[7w{1.!.4.....&.Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:pO5t:Qt
MD5:	72E2136A7035BE4057449D4AA6EFD990
SHA1:	1FD477932471ED26751A9AA005CD7B0549D44F4B
SHA-256:	DD383AE48A85C931941CDEC698D141D8F36FA342AA77EA99AF0A86EA6E9F10ED
SHA-512:	A844CC7D36146299A0259C76CCC967B72EF17B567F4F45E79B74AF9FBAF8DAA89A8241910AA8AA9F38D61C1115DD8516E2EFF9951EF676FBA129AF1BECACCCAC
Malicious:	true
Reputation:	low
Preview:	..M....H

C:\Users\user\AppData\Roaming\YwKZCbS.exe Download File
Process:	C:\Users\user\Desktop\7lrH3syQoO.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	672256
Entropy (8bit):	7.785855042248575
Encrypted:	false
SSDEEP:	12288:PA1VAO6pPeZvyhDaFOrfY79pi2A0BvCEiMjVQkz0YKdOqLD0yqYlU:PIAO6pPmYaMQ4QCUjVQkI8w07uU
MD5:	60C423711D537751BC90E037100AFF0C
SHA1:	ED0AFA5C41F18C5C61866F2E097ACBD091190037
SHA-256:	F57A18111A889D227696128EF7486897B7C35F2F81DB4C6C930263786BBC2852
SHA-512:	29CDD6C053C29C23CEADF5015EBD8B828195E059FBB39133DC50CB3E9E7C3AC66847F8A357E68B96C6B74431ABE5B70C1032C20A89D53302F60059896D4A8A2F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 30%, Browse Antivirus: ReversingLabs, Detection: 58%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....m`..............P......".......=... ...@....@.. ....................................@.................................\=..O....@..t....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...t....@... ... ..............@..@.reloc.......`.......@..............@..B.................=......H.......d...@.......h....u................................................(....&..( .....s!........s"........s#........s$........s%...........0...........~....o&....+...0...........~....o'....+...0...........~....o(....+...0...........~....o)....+...0...........~....o....+...0..<........~.....(+.....,!r...p.....(,...o-...s.............~.....+...0...........~.....+.."........0..&........(....r3..p~....o/...(0.....t%....+..*...0..&........(....rE..p~....o/...(0.....

C:\Users\user\AppData\Roaming\YwKZCbS.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\7lrH3syQoO.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.785855042248575
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	7lrH3syQoO.exe
File size:	672256
MD5:	60c423711d537751bc90e037100aff0c
SHA1:	ed0afa5c41f18c5c61866f2e097acbd091190037
SHA256:	f57a18111a889d227696128ef7486897b7c35f2f81db4c6c930263786bbc2852
SHA512:	29cdd6c053c29c23ceadf5015ebd8b828195e059fbb39133dc50cb3e9e7c3ac66847f8a357e68b96c6b74431abe5b70c1032c20a89d53302f60059896d4a8a2f
SSDEEP:	12288:PA1VAO6pPeZvyhDaFOrfY79pi2A0BvCEiMjVQkz0YKdOqLD0yqYlU:PIAO6pPmYaMQ4QCUjVQkI8w07uU
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....m`..............P......".......=... ...@....@.. ....................................@................................

File Icon


Icon Hash:	acd292d2c9ccb698

Static PE Info

General
Entrypoint:	0x4a3dae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x606D06EB [Wed Apr 7 01:12:11 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa3d5c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x1f74	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa1db4	0xa1e00	False	0.859411196911	data	7.79874403278	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x1f74	0x2000	False	0.375732421875	data	6.01422569737	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa6000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xa4130	0x10a8	data
RT_GROUP_ICON	0xa51d8	0x14	data
RT_VERSION	0xa51ec	0x3ac	data
RT_MANIFEST	0xa5598	0x9d9	XML 1.0 document, UTF-8 Unicode (with BOM) text

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2012
Assembly Version	0.1.0.0
InternalName	FieldAttributes.exe
FileVersion	0.1.0.0
CompanyName	Christopher Diekkamp
LegalTrademarks
Comments	Tally Input Output Processor
ProductName	TallyProcessor
ProductVersion	0.1.0.0
FileDescription	TallyProcessor
OriginalFilename	FieldAttributes.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/12/21-08:30:38.017655	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49717	59044	192.168.2.5	172.94.38.41
04/12/21-08:30:45.033039	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49721	59044	192.168.2.5	172.94.38.41
04/12/21-08:30:52.546499	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49722	59044	192.168.2.5	172.94.38.41
04/12/21-08:30:59.159888	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49723	59044	192.168.2.5	172.94.38.41
04/12/21-08:31:09.649454	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49725	59044	192.168.2.5	172.94.38.41
04/12/21-08:31:17.242218	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49726	59044	192.168.2.5	172.94.38.41
04/12/21-08:31:23.825988	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49729	59044	192.168.2.5	172.94.38.41
04/12/21-08:31:31.163145	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49732	59044	192.168.2.5	172.94.38.41
04/12/21-08:31:37.953804	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49733	59044	192.168.2.5	172.94.38.41
04/12/21-08:31:44.974754	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49734	59044	192.168.2.5	172.94.38.41
04/12/21-08:31:51.756158	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49736	59044	192.168.2.5	172.94.38.41
04/12/21-08:31:58.722742	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49737	59044	192.168.2.5	172.94.38.41
04/12/21-08:32:05.906274	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49738	59044	192.168.2.5	172.94.38.41
04/12/21-08:32:12.942153	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49741	59044	192.168.2.5	172.94.38.41
04/12/21-08:32:19.885617	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49742	59044	192.168.2.5	172.94.38.41

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 08:30:37.570306063 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:37.819314957 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:37.819504023 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:38.017654896 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:38.304229975 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:38.401185989 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:38.440798998 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:38.691380024 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:38.691514969 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:38.982623100 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:38.983216047 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.304588079 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.351990938 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.352025032 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.352044106 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.352060080 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.352077961 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.352160931 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.352212906 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.352741957 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.352761030 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.352801085 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.352842093 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.352843046 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.352876902 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.354060888 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.356270075 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.602499962 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.602538109 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.602564096 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.602587938 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.602653980 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.602689028 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.604804039 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.604837894 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.604861975 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.604945898 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.605321884 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.605376005 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.605417013 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.605454922 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.605480909 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.605504990 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.605505943 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.605530977 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.605554104 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.605576992 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.605580091 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.605608940 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.608419895 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.608448982 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.608473063 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.608496904 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.608515978 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.608576059 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.609206915 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.609306097 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.617131948 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.845820904 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.845856905 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.845880032 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.845901012 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.845921993 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.845999002 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.846029043 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.846474886 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.846681118 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.846715927 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.846734047 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.846797943 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.846853018 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.846853971 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.847007990 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.847661972 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.847681999 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.847697973 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.847724915 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.847748041 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.847758055 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.847768068 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.847804070 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.847817898 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.847843885 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.854232073 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.854263067 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.854285955 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.854305983 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.854326963 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.854403019 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.854484081 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.855159044 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855227947 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855299950 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.855305910 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855324030 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855341911 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855355024 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.855375051 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855413914 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855428934 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855439901 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.855489016 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.855489016 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855506897 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855525970 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855537891 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.855547905 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855571985 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855595112 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855604887 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.855623007 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.855720043 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.859766006 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.859791040 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.859808922 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.859826088 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.859843969 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:39.859880924 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.859942913 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:39.904756069 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.091525078 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.091573954 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.091605902 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.091631889 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.091648102 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.091660023 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.091682911 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.092536926 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.092569113 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.092595100 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.092622042 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.092626095 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.092648029 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.094063997 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.094185114 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.094247103 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.094264984 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.094325066 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.094540119 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.094660044 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.094727039 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.095810890 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.095829010 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.095841885 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.095897913 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.095911980 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.095958948 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.098588943 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.098649025 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.098666906 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.098683119 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.098696947 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.098737001 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.098762989 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.107768059 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.107824087 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.107851028 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.107876062 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.107903957 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.107928038 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.107930899 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.107959986 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.107990026 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.108011961 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.108068943 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.108246088 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.108306885 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.109236956 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.109689951 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.109750986 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.110115051 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.110820055 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.110888004 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.111330032 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112006903 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112087965 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.112284899 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112533092 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112600088 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.112660885 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112807989 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112829924 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112853050 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112859964 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.112893105 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.112905025 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112951994 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112973928 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.112997055 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.113001108 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.113040924 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.342360973 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.342395067 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.342415094 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.342500925 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.342524052 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.342588902 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.343194962 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.343221903 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.343276024 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.343280077 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.343332052 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.343353033 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.343381882 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.344547987 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.344572067 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.344588995 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.344705105 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.344777107 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349502087 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349529028 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349615097 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349643946 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349648952 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.349673033 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349689960 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349706888 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.349730015 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.349731922 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349771976 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.349785089 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349912882 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.349961996 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.350085974 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.351785898 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.351809978 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.351828098 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.351844072 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.351845980 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.351871967 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.351886988 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.351933956 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.352257967 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.352277040 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.352328062 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.352375031 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.353235960 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.353297949 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.356075048 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.356101990 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.356128931 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.356152058 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.356205940 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.356205940 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.356241941 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.356898069 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.356921911 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.356959105 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.356976032 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.357007027 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.357036114 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.357058048 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.357095003 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.358014107 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.358042955 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.358067036 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.358089924 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.358164072 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.359968901 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.359996080 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.360116005 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.591520071 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.591573000 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.591594934 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.591620922 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.591645956 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.591739893 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.591793060 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.598995924 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.599025011 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.599036932 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.599055052 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.599163055 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.599417925 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.599481106 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.599493027 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.599524975 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.599541903 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.599570990 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.599574089 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.599627972 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.600899935 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.600929022 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.600953102 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.600969076 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.600990057 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.601018906 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.601077080 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.601807117 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.601826906 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.601840019 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.601855993 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.601876020 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.601887941 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.601916075 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.601931095 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.602421999 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.602438927 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.602497101 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.602500916 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.602544069 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.602622986 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.602677107 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.602745056 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.602791071 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.603322983 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.603419065 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.603429079 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.603462934 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.603483915 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.603519917 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.603544950 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.603595972 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.603637934 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.603686094 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.604521036 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.604540110 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.604609966 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.604619980 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.604666948 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.604912996 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.604938984 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.604980946 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.605003119 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.606143951 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.606175900 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.606200933 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.606250048 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.606277943 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.606306076 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.606329918 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.606353998 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.606385946 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.607310057 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.607340097 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.607398033 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.607418060 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.607426882 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.607471943 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.607639074 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.607690096 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.607867956 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.607934952 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:40.963985920 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:40.964149952 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.150134087 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150161028 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150177956 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150197983 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150216103 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150218964 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.150250912 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.150298119 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150301933 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.150331020 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150346994 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.150376081 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.150926113 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150947094 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150975943 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.150990963 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151025057 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151109934 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151159048 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151186943 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151228905 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151266098 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151309013 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151309967 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151350021 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151354074 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151391983 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151473999 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151494980 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151521921 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151544094 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151648045 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151704073 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151760101 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151819944 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.151850939 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.151897907 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.152004004 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.152054071 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.152162075 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.152219057 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.152616978 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.152686119 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:41.152721882 CEST	59044	49717	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:41.152771950 CEST	49717	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:44.764281034 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:45.032186031 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:45.032326937 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:45.033039093 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:45.332997084 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:45.431858063 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:45.432375908 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:45.683339119 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:45.683541059 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:45.980916023 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:45.981000900 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.280958891 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.338112116 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.338161945 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.338191986 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.338247061 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.338857889 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.338892937 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.338920116 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.338939905 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.338963032 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.345062971 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.345109940 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.345139980 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.345165968 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.345211029 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.345244884 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.591639042 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.591674089 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.591696024 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.591722012 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.591743946 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.591850996 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.592575073 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.592602015 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.592628002 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.592638969 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.592650890 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.592679024 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.593456984 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.593487024 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.593507051 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.593521118 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.593533993 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.594428062 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.594532013 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.594563961 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.594599009 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.594616890 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.594777107 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.595550060 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:46.595628023 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:46.664807081 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.021874905 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.022111893 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.221848011 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.221879959 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.221894979 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.221920967 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.221945047 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.222016096 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.222098112 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.222800970 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.222832918 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.222862005 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.222889900 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.222910881 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.222963095 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.223040104 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.226015091 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226054907 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226083994 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226115942 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226146936 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226174116 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.226177931 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226210117 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226214886 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.226239920 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226267099 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226290941 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.226298094 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226329088 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226345062 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.226362944 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226392984 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226407051 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.226423025 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226454020 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226459026 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.226504087 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.226882935 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226912022 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226942062 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226969957 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.226972103 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.226999998 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.227029085 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.227068901 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.228486061 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.228576899 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.228626966 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.228703976 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.252175093 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.505781889 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.505840063 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.505860090 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.505876064 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.505893946 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.505896091 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.505918980 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.506769896 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.506794930 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.506813049 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.506831884 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.506849051 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.506866932 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.506916046 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.507705927 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.507777929 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.507797956 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.507814884 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.507832050 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.507833958 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.507855892 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.508881092 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.508950949 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.508980989 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.509058952 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.509077072 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.510674953 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.510695934 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.510699034 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.517781019 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.517810106 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.517822027 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.517858982 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.517905951 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.518022060 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.518183947 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.518261909 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.518522978 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.518547058 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.518587112 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.518608093 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.518610954 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.518613100 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.518615007 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.518775940 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.518851995 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.518904924 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.519093990 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.519196987 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.519269943 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.519519091 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.519763947 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.519818068 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.519864082 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.520116091 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.520174026 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.520252943 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.571532965 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.571567059 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.571584940 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.571605921 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.571625948 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.571669102 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.571697950 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.572293997 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.572371006 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.572391033 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.572499990 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.572561026 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.572627068 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.649152994 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.751869917 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.751903057 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.751918077 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.752058983 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.759578943 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.759608984 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.759627104 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.759644032 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.759660006 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.759740114 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.759797096 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.760251045 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.760276079 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.760308027 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.760317087 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.760361910 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.760379076 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.760391951 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.760446072 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.769110918 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.769138098 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.769150019 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.769170046 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.769187927 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.769303083 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.769565105 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.769624949 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.769795895 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.769906044 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.770200968 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.770478964 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.770525932 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.770843029 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.770900011 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.771121025 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.771270990 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.771282911 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.771301031 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.771305084 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.771316051 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.771522999 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.771625996 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.771689892 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.771765947 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.771907091 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.771981955 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.772073984 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.772103071 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.772144079 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.772169113 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.772442102 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.772500992 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.772630930 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.772679090 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.772964954 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.773029089 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.831276894 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.831295967 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.831315041 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.831331015 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.831346989 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.831466913 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.831561089 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.832247972 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.832330942 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.832350016 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.832370996 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.832541943 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.832560062 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.832564116 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:47.841403008 CEST	59044	49721	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:47.841588020 CEST	49721	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:52.254118919 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:52.503443956 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:52.503580093 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:52.546499014 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:52.839430094 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:52.839570999 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:52.941485882 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:52.941577911 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:53.132838964 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:53.133063078 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:53.405718088 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:53.407090902 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:53.961409092 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:53.961486101 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.020334005 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.020451069 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.101970911 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.102001905 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.102015972 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.102032900 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.102179050 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.102258921 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.102727890 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.102782011 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.102804899 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.102816105 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.102824926 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.102844954 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.102848053 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.102897882 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.103789091 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.103859901 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.304727077 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.361660957 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.361692905 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.361709118 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.361725092 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.361756086 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.361782074 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.362555981 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.362579107 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.362610102 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.362633944 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.362663984 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.362695932 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.371551991 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372174025 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372203112 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372226000 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372250080 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372272015 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372272015 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.372294903 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372317076 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.372319937 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372343063 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372375965 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.372375965 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372400999 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372433901 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.372670889 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.372733116 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.602477074 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.621407986 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.621443033 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.621457100 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.621469975 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.621489048 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.621575117 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.621675014 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.622443914 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.622539997 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.622560978 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.622601986 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.622719049 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.622796059 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.623583078 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.623617887 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.623641968 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.623665094 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.623671055 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.623725891 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.623739958 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.624346018 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.624423027 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.624449968 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.624473095 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.624525070 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.624537945 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.626358032 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.626415968 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.626456022 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.626466990 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.626492977 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.626539946 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.626569033 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.626626015 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.627314091 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.627341032 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.627391100 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.627481937 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.627546072 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.627568960 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.627607107 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.628438950 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.628460884 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.628479958 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.628509045 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.628520012 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.628536940 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.628563881 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.628597975 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.629359007 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.629378080 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.629416943 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.629436970 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.629453897 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.629467964 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.629511118 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.630497932 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.630594015 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.743479013 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:54.991220951 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:54.991470098 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.101840019 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.101876974 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.101898909 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.101919889 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.102000952 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.102030993 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.102927923 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.102957010 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.102979898 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.102993965 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.103002071 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.103050947 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.103055000 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.103074074 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.103838921 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.103862047 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.103878021 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.103899956 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.103915930 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.103916883 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.104065895 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.104619980 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.104681015 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.104717970 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.104774952 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.104803085 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.104824066 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.104859114 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.104924917 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.105683088 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.105716944 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.105762959 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.105779886 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.105794907 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.105822086 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.105848074 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.105849028 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.105875015 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.105912924 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.106911898 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.106940985 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.106962919 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.106986046 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.106986046 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.107029915 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.107909918 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.107939005 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.107984066 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.107991934 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.108015060 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.108030081 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.108037949 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.108055115 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.108087063 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.108900070 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.108931065 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.108952045 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.108973026 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.108973980 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.108995914 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.109041929 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.109761000 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.109782934 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.109812975 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.109839916 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.109888077 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.109910011 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.109929085 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.109956980 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.110775948 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.110824108 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.110857964 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.110878944 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.110913038 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.110922098 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.110925913 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.110948086 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.111077070 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.218497038 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.218529940 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.218552113 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.218571901 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.218576908 CEST	59044	49722	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:55.218611956 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:55.218631029 CEST	49722	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:58.876647949 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:59.131803989 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:59.131964922 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:59.159888029 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:59.456623077 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:59.541702032 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:59.548275948 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:30:59.801542997 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:30:59.801770926 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.088354111 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.088430882 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.372858047 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.431627035 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.431662083 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.431684017 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.431703091 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.431827068 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.431869984 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.432482004 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.432503939 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.432523012 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.432545900 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.432571888 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.432619095 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.433451891 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.433520079 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.433581114 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.701266050 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.701298952 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.701323986 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.701337099 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.701493979 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.702642918 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.702671051 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.702686071 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.702702045 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.702766895 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.702800035 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.703219891 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.703254938 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.703294039 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.703320980 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.703335047 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.703370094 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.704121113 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.704185009 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.704262018 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.704333067 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.704349995 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.704396009 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.704437971 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.705221891 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.705261946 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.705280066 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.705296040 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.705328941 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.776325941 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.961122990 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.961154938 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.961167097 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.961183071 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.961366892 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.962059975 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.962119102 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.962152958 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.962163925 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.962198019 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.962224960 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.962318897 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.962373972 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.963099957 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.963139057 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.963157892 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.963179111 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.963181973 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.963211060 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.963248014 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.963284016 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.963340044 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.964183092 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.964209080 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.964230061 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.964246988 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.964293003 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.964323044 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.965121984 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.965150118 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.965171099 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.965184927 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.965207100 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.965265989 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.968338013 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.968363047 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.968379021 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.968394995 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.968410969 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.968501091 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.968537092 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.969208956 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.969229937 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.969245911 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.969260931 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.969285011 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.969333887 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.970477104 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.970504045 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.970519066 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.970535040 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.970551014 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.970583916 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.970613003 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.971430063 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.971508980 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.971601009 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.971664906 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.971735001 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.971787930 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.971790075 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.971837044 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:00.972863913 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:00.972939968 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.061784029 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.217827082 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.217855930 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.217870951 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.217888117 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.217904091 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.217922926 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.217989922 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.218000889 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218019962 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218035936 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218064070 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.218091965 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.218231916 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218250990 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218308926 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218312025 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.218324900 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218384981 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.218522072 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218554974 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218641043 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.218655109 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.218965054 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.219019890 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.219022036 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.219415903 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.219439030 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.219500065 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.219599009 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.219650030 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.219685078 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.219871998 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.219944000 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.220027924 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.220114946 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.220165014 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.220321894 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.220614910 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.220681906 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.220804930 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.220876932 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.220944881 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.221612930 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.221679926 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.221741915 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.221750021 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.221766949 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.221817970 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.221877098 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.221915960 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.221961021 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.222079039 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.222321987 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.222338915 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.222389936 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.222605944 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.222670078 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.223185062 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.223649025 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.223779917 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.224087000 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.224488974 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.224555969 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.224766016 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.224782944 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.224817038 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.224828005 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.224958897 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.224998951 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.225011110 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.225049973 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.225096941 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.471884966 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.471924067 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.471940994 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.471957922 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.472198009 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.472789049 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.472812891 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.472832918 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.472851038 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.472877979 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.472894907 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.472925901 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.473819971 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.473848104 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.473864079 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.473881006 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.473961115 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.474793911 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.474822998 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.474841118 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.474869013 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.474881887 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.474896908 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.474925995 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.475894928 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.475920916 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.475936890 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.476007938 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.476007938 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.476047039 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.476078987 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.476800919 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.476824999 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.476885080 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.476886988 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.476923943 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.476938009 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.476942062 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.476995945 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.477969885 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.477996111 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.478013039 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.478033066 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.478106022 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.478137016 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.478804111 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.478971958 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.478998899 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.479024887 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.479043961 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.479074955 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.479096889 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.479931116 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.479957104 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.479973078 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.479990959 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.480012894 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.480057955 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.480845928 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.480870962 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.480887890 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.480902910 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.480931044 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.480966091 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.481760979 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.481785059 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.481803894 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.481822014 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.481854916 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.481885910 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.759808064 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.821577072 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.821721077 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.981617928 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.981712103 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.988396883 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.988428116 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.988444090 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.988461018 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.988476992 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.988554001 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.988607883 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.997574091 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.997601032 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.997616053 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.997632980 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.997649908 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.997669935 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.997716904 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.997767925 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.997808933 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.997931957 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.997967958 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.997999907 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.998061895 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.998255014 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.998326063 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.998368979 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.998478889 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.998506069 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.998558044 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.998613119 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.998665094 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.998861074 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.998913050 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.999104023 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.999340057 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.999350071 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.999440908 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.999573946 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.999629974 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.999650002 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.999694109 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.999711037 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:01.999774933 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:01.999978065 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.000026941 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.000093937 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.000161886 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.000294924 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.000334978 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.000436068 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.000495911 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.002432108 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.002463102 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.002479076 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.002495050 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.002530098 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.002557039 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.002580881 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.002651930 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.002670050 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.002698898 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.002729893 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.003259897 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.003288031 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.003336906 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.003336906 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.003376007 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.003385067 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.003418922 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.003572941 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.003627062 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.003984928 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.004061937 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.004091978 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.004112959 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.004133940 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.004179955 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.004251957 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.004301071 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.004535913 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.004590988 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.004611969 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.004703999 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.004854918 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.004908085 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.004947901 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.004995108 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.005259991 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.005320072 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.005373001 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.005422115 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.005577087 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.005611897 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.005624056 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.005654097 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.005815983 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.005865097 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.005979061 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.006031036 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.006398916 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.006432056 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.006474018 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.006503105 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.006520033 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.006572008 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.006655931 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.006707907 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.006767988 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.006817102 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.006985903 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.007040024 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.007096052 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.007153034 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.007334948 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.007384062 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.007425070 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.007472992 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.007658958 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.007704973 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.007786036 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.007838964 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.008106947 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.008161068 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.008385897 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.008428097 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.008538961 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.008584976 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.008727074 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.008747101 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.008788109 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.008842945 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.008893013 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.008975029 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.009021997 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.009179115 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.009243965 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.009295940 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.009346008 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.009512901 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.009567022 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.009668112 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.009720087 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.009808064 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.009855986 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.010045052 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.010094881 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.010220051 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.010281086 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.010490894 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.010551929 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:02.010607004 CEST	59044	49723	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:02.010656118 CEST	49723	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:05.950359106 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:08.962518930 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:09.568388939 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:09.568655014 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:09.649454117 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:09.962312937 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:10.044423103 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:10.087629080 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:10.409560919 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:10.663057089 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:10.663239956 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:10.992013931 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:10.992088079 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.284693003 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343127966 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343158960 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343172073 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343211889 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343230963 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343246937 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343347073 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343405962 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.343414068 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343497038 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.343523979 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.344481945 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.344578028 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.401570082 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.591694117 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.591722965 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.591736078 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.591748953 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.591764927 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.591937065 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.592988968 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.593041897 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.593061924 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.593101025 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.593115091 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.593220949 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.594237089 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594260931 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594274044 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594286919 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594302893 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594355106 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.594425917 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.594496965 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594567060 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.594572067 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594589949 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594654083 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.594655991 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594696045 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.594739914 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.594820023 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.595655918 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.595829964 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.686394930 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.835509062 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.837497950 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.837533951 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.837557077 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.837579012 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.837599039 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.837714911 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.837824106 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.838521004 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.838570118 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.838593006 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.838613033 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.838651896 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.838735104 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.839318037 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.839380980 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.839421988 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.839728117 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.839764118 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.839787960 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.839838982 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.839915991 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.840553045 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.840581894 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.840637922 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.840661049 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.840683937 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.840687990 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.840797901 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.841475010 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.841505051 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.841588020 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.842596054 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.842657089 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.842679977 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.842701912 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.842713118 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.842772961 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.842801094 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.842884064 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.843676090 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.843750954 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.843775988 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.843796968 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.843817949 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.843828917 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.843892097 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.844836950 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.844959974 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.845066071 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.845170975 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.845195055 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.845242023 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.845299959 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.845369101 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:11.845979929 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.846010923 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:11.846136093 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.122157097 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.122200966 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.122217894 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.122236013 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.122380018 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.122746944 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.122776985 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.122793913 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.122812986 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.122834921 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.122864008 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.123743057 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.123780966 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.123853922 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.123877048 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.128920078 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.128954887 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.128972054 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.128992081 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.129009008 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.129092932 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.129146099 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.129694939 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.129829884 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.129911900 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.129913092 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.129941940 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.130000114 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.130012035 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.130853891 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.130876064 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.130892992 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.130935907 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.130940914 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.130994081 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.131032944 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.131088972 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.131803989 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.131825924 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.131906986 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.131923914 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.131927013 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.131973982 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.131994963 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.132931948 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.132956982 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.132986069 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.133034945 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.133066893 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.133089066 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.133656979 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.133723974 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.136195898 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.136221886 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.136238098 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.136255026 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.136271000 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.136305094 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.136359930 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.136904001 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.136926889 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.136990070 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.136992931 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.137038946 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.137079954 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.137203932 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.137255907 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.137312889 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.152374029 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.152539015 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.371398926 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.371433973 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.371448040 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.371459961 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.371503115 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.371615887 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.372360945 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.372390032 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.372432947 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.372468948 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.372524977 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.372551918 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.373296976 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.373356104 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.373559952 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.373579979 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.373627901 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.373678923 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.373707056 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.373758078 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.374463081 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.374485970 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.374538898 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.374684095 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.374738932 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.374784946 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.374797106 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.375463009 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.375484943 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.375530005 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.378422022 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.378447056 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.378458977 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.378551006 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.378552914 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.378616095 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.378678083 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.380688906 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.380736113 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.380786896 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.380811930 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.380877018 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.380932093 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.381437063 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.381458044 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.381511927 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.381535053 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.389636040 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.389667034 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.389794111 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.395966053 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.395994902 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.396007061 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.396019936 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.396037102 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.396161079 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.396452904 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.396604061 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.396670103 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.396675110 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.396719933 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.396765947 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.396769047 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.397532940 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.397558928 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.397576094 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.397612095 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.397713900 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.397805929 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.402164936 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.647856951 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.647887945 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.647900105 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.647912979 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.648001909 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.648081064 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.648125887 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.648823977 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.648880959 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.648904085 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.648930073 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.648962021 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.648993969 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.649010897 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.649034977 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.649035931 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.649054050 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.649091005 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.649306059 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.649352074 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.649354935 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.649399042 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.649593115 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.649641991 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.650892973 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.650933981 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.651004076 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.651007891 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.651058912 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.651072979 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.651091099 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.651119947 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.651143074 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.651978970 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.652005911 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.652024031 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.652041912 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.652060986 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.652060986 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.652098894 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.653203964 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.653228998 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.653273106 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.653283119 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.653305054 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.653321028 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.653340101 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.653398991 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.653901100 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.653924942 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.653975964 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.654010057 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.654028893 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.654047012 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.654057026 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.654095888 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.655234098 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.655256033 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.655281067 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.655313015 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.655322075 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.655339003 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.655363083 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.655364037 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.655411959 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.656063080 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.656089067 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.656116962 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.656136990 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.656168938 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.656169891 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.656209946 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.656213045 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.656259060 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.657299995 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.657418013 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.657426119 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.657447100 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.657481909 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.657481909 CEST	59044	49725	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:12.657512903 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:12.657538891 CEST	49725	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:16.627829075 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:17.241239071 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:17.241492987 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:17.242218018 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:17.641701937 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:17.641786098 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:17.641880035 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:17.925003052 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:17.927577019 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:18.251610994 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.252984047 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:18.581414938 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.585659027 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:18.632148027 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.632261992 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.632278919 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.632299900 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.632381916 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:18.632424116 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:18.633546114 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.633577108 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.633594990 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.633615017 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.633719921 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:18.633739948 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:18.634530067 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.634552002 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:18.634624004 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.089194059 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.089284897 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.089353085 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.089374065 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.089430094 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.089438915 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.089466095 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.089529037 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.091429949 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.091500998 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.091564894 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.091587067 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.091589928 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.091648102 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.091649055 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.091706991 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.091708899 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.091788054 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.091810942 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.091979027 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.091984034 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.092051029 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.092108011 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.092158079 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.092499971 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.092571020 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.097767115 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.097816944 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.097853899 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.097857952 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.097882032 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.097889900 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.097908020 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.097924948 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.097943068 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.097966909 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.099138021 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.099179983 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.099200964 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.099224091 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.341773987 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.341809988 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.341829062 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.341845989 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.341891050 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.341945887 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.342621088 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.342693090 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.342786074 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.342839956 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.343130112 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.343404055 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.343626976 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.343692064 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.343916893 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.343975067 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.346206903 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.346225977 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.346242905 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.346260071 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.346275091 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.346282959 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.346292019 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.346309900 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.346329927 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.346338034 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.346349001 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.346362114 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.346394062 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.349215984 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.349236965 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.349252939 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.349268913 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.349284887 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.349303007 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.349303961 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.349319935 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.349337101 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.349355936 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.349399090 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.350855112 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.350917101 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.350933075 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.350970030 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.351711988 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.351766109 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.352025032 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352042913 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352061033 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352082968 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.352111101 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.352665901 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352684975 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352701902 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352727890 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.352758884 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.352818012 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352837086 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352863073 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.352880955 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.352961063 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352979898 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.352996111 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.353003025 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.353024960 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.448441029 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.589781046 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.589812994 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.589829922 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.589852095 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.589868069 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.589941025 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.590266943 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.591043949 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.591074944 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.591149092 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.591166973 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.591183901 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.591224909 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.591294050 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.591345072 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.592221975 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.592245102 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.592264891 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.592282057 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.592298985 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.592319012 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.592398882 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.593435049 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.593456030 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.593473911 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.593492031 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.593508005 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.593523979 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.593560934 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.594104052 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.594122887 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.594141960 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.594170094 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.594203949 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.594211102 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.594260931 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.594707012 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.594763994 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.594769001 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.594805956 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.595066071 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.595084906 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.595102072 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.595119953 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.595149040 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597225904 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597335100 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597352982 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597440958 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597450018 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597491980 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597492933 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597537041 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597542048 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597577095 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597579956 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597621918 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597657919 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597676039 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597702026 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597718000 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597723961 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597764015 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597784042 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597832918 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597846985 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597887039 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597914934 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597927094 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597929001 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.597966909 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.597997904 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.598012924 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.598017931 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.598058939 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.598786116 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.598886013 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.598956108 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.599014044 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.599061012 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.599138021 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.599169970 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.599219084 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:19.694760084 CEST	59044	49726	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:19.694892883 CEST	49726	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:23.568537951 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:23.824995995 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:23.825107098 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:23.825988054 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:24.124655008 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:24.222086906 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:24.223193884 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:24.651215076 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:24.651649952 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:24.934209108 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:24.934359074 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.240740061 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.282231092 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.282258987 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.282280922 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.282402039 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.290026903 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.290066957 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.290090084 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.290112019 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.290204048 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.290528059 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.290555954 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.290579081 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.290616035 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.290656090 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.448847055 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.531471968 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.531505108 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.531524897 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.531546116 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.531636953 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.531676054 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.532403946 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.532437086 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.532463074 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.532525063 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.532562971 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.538465023 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.538489103 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.538506031 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.538521051 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.538583994 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.538614035 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.539518118 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.539544106 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.539560080 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.539578915 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.539596081 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.539618015 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.539664030 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.540436029 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.540456057 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.540476084 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.540493011 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.540527105 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.540549994 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.741262913 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.778697014 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.778737068 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.778767109 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.778795004 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.778808117 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.778865099 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.779597044 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.786649942 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.786686897 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.786780119 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.786968946 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.786998034 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.787074089 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.788127899 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788162947 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788199902 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788223028 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788225889 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.788250923 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.788362026 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788395882 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788419008 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788439035 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788460016 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788470984 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.788510084 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.788814068 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788847923 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788872004 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.788917065 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.789077044 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.789637089 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.789664030 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.789720058 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.789745092 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.789844990 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.789911985 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.799544096 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799582958 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799607038 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799628973 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799649954 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799669981 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799693108 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799706936 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.799717903 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799735069 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.799740076 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799762011 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.799792051 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.799840927 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.799921036 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.800040960 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.800139904 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:25.800165892 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.801698923 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:25.801783085 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.031676054 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.031753063 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.031793118 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.031827927 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.031862974 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.031944990 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.032583952 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.032635927 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.032663107 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.032687902 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.032742977 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.032762051 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.033581018 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.033606052 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.033668041 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.033723116 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.033740044 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.033761024 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.033812046 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.034625053 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.034652948 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.034667969 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.034701109 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.034718990 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.035106897 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.035131931 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.035181046 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.035609007 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.035633087 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.035649061 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.035667896 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.035703897 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.035727024 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.036539078 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.036562920 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.036575079 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.036650896 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.038630009 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.038669109 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.038703918 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.038719893 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.038789988 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.038805008 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.039732933 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.039818048 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.039838076 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.039855003 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.039892912 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.039915085 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.040708065 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.040738106 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.040793896 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.040837049 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.040857077 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.040875912 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.040884972 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.040923119 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.041626930 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.041659117 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.041682005 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.041739941 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.041739941 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.041793108 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.042674065 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.042881966 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.042901993 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.042917013 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.042983055 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.042999983 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.043983936 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.044008017 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.044094086 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.282766104 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.282805920 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.282860041 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.282901049 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.305562973 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.305604935 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.305684090 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.305877924 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.305937052 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.305979013 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.307367086 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.307418108 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.307440996 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.307447910 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.307483912 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.307576895 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.307689905 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.307744980 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.308279991 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.308458090 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.308521986 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.308701992 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.308727026 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.308785915 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.309523106 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.309643984 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.309674978 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.309699059 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.309700012 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.309720993 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.309743881 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.309768915 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.309809923 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.309812069 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.309848070 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.309900999 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.310022116 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.310182095 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.310236931 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.310252905 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.310370922 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.310400963 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.310424089 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.310678005 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.310744047 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.310862064 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.310977936 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311007023 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311028957 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311037064 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.311084032 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.311086893 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311109066 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311131001 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311161995 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.311294079 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311321974 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311352015 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.311877012 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311912060 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.311949015 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.311968088 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.312015057 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.312016010 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.312321901 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.312401056 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.312419891 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.312446117 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.312494993 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.312504053 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.312517881 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.312572002 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.466082096 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.572139978 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.572168112 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.572190046 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.572211981 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.572236061 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.572285891 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.573129892 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.573152065 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.573216915 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.578310013 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.578341961 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.578365088 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.578383923 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.578411102 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.578440905 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.579106092 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.579178095 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.579190016 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.579204082 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.579225063 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.579241991 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.579247952 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.579267979 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.579298973 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.580271006 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.580307961 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.580331087 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.580357075 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.580359936 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.580379963 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.580405951 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.580425978 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.581248045 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.581285000 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.581310987 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.581315041 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.581334114 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.581342936 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.581358910 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.581363916 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.581396103 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.581408024 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.582148075 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.582178116 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.582200050 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.582216978 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.582226992 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.582271099 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.583132029 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.583157063 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.583178043 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.583189964 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.583200932 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.583237886 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.583255053 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.583275080 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.583311081 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.584124088 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.584151983 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.584172010 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.584192038 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.584199905 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.584218979 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.584253073 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.584271908 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.584310055 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.585244894 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.585274935 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.585299015 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.585316896 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.585320950 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.585342884 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.585352898 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.585397005 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.586141109 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.586218119 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.586270094 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.586296082 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.586318016 CEST	59044	49729	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:26.586318016 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.586339951 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:26.586359024 CEST	49729	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:30.920022011 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:31.161375999 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:31.162317991 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:31.163145065 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:31.564774990 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:31.564915895 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:31.572530031 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:31.572624922 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:31.854765892 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:31.858524084 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.192454100 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.194312096 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.592263937 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.592333078 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.592402935 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.592411041 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.592436075 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.592467070 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.592470884 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.592516899 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.592518091 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.592576981 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.593235970 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.593305111 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.593310118 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.593362093 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.593374968 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.593477011 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.593513966 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.593569040 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.594383955 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.594448090 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.594455957 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.594502926 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.848799944 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.848841906 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.848872900 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.848905087 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.848927021 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.848933935 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.848964930 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.848973989 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.849024057 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.849282026 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.849315882 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.849363089 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.849579096 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.850668907 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.850703001 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.850747108 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.850922108 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.850955963 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.850979090 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.851820946 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.851885080 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.851922035 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.851957083 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.851986885 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.852014065 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.852663994 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.852713108 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.852730989 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:32.852760077 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:32.852814913 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.212305069 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.212349892 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.212526083 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.213150024 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.213198900 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.213243008 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.213267088 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.214395046 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.214440107 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.214498043 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.215249062 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.215306044 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.215308905 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.216155052 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.216222048 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.216264009 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.216425896 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.216475010 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.216536045 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.216586113 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.216630936 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.217228889 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.217305899 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.217346907 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.217360020 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.217430115 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.217482090 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.218427896 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.218468904 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.218516111 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.218537092 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.218560934 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.218611002 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.219258070 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.219300032 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.219338894 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.219362020 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.219377995 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.219427109 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.219454050 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.220318079 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.220371962 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.220403910 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.220417023 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.220457077 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.220463037 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.221468925 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.221524000 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.221570969 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.221576929 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.221615076 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.221616983 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.222357035 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.222438097 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.222449064 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.277077913 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.449851036 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.463510990 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.463576078 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.463628054 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.463675022 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.463690996 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.463732958 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.464112997 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.464184999 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.466643095 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.466758013 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.469741106 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.469819069 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.469856024 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.469872952 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.469892025 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.469919920 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.469922066 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.469961882 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.471827984 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.471893072 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.471940041 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.471949100 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.471982956 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.471999884 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.472018003 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.472048044 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.472078085 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.472100019 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.472101927 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.472147942 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.473016024 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.473088980 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.475634098 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.475716114 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.477653027 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.477746010 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.478636026 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.478671074 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.478697062 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.478718996 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.478720903 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.478738070 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.478759050 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.478821039 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.479254007 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.479281902 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.479305029 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.479317904 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.479326963 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.479353905 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.479409933 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.479866028 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.479892015 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.479959011 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.480942011 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.481029987 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.481422901 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.481496096 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.485239983 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.485306978 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.485331059 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.485398054 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.485512018 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.485533953 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.485549927 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.485559940 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.485569954 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.485601902 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.485611916 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.487297058 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.487329006 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.487351894 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.487363100 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.487375021 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.487399101 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.487401962 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.487428904 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.487442970 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.487478018 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:33.621293068 CEST	59044	49732	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:33.621484995 CEST	49732	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:37.702956915 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:37.952928066 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:37.953109980 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:37.953804016 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:38.245588064 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:38.322423935 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:38.322694063 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:38.592097998 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:38.592223883 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:38.879960060 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:38.880115986 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.412247896 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.450236082 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.482055902 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.482089996 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.482114077 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.482136965 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.482173920 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.482238054 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.482881069 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.482985020 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.483012915 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.483036041 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.483036995 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.483062983 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.483089924 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.483136892 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.484159946 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.484261990 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.751753092 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.751786947 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.751804113 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.751823902 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.751844883 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.751904964 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.751949072 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.753530025 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.753562927 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.753587008 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.753612041 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.753624916 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.753664970 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.753838062 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.753863096 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.753922939 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.754117966 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.754192114 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.754271984 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.754328012 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.754563093 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.754587889 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.754695892 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.754730940 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.754755974 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.754800081 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.754812956 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.755101919 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.755172014 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:39.755609035 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:39.755970001 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.001482964 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.001513958 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.001527071 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.001539946 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.001666069 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.001701117 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.002660990 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.002685070 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.002702951 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.002720118 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.002734900 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.002931118 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.003287077 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.003344059 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.003456116 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.003496885 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.003513098 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.003556013 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.004379034 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.004400969 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.004446983 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.004467010 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.004466057 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.004494905 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.004530907 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.004645109 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.005485058 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.005508900 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.005527020 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.005543947 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.005575895 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.005626917 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.005646944 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.006181002 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.006293058 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.006500959 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.006573915 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.006592035 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.006608963 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.006747007 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.006763935 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.007888079 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.007910013 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.007940054 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.007956028 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.007972002 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.008030891 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.008049965 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.008578062 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.008596897 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.008657932 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.008673906 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.008766890 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.008784056 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.009298086 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.009334087 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.009423971 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.009603024 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.011010885 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.252077103 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.252120972 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.252152920 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.252183914 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.252214909 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.252237082 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.252293110 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.252743959 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.252777100 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.252799034 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.252819061 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.253065109 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.253093958 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.253712893 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.253799915 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.253823042 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.253855944 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.253909111 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.253907919 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.253935099 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.254044056 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.254699945 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.254726887 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.254765987 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.254877090 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.254909039 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.254967928 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.254995108 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.255114079 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.255140066 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.255163908 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.255188942 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.255228043 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.255357981 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.255469084 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.255579948 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.256897926 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.256923914 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.256943941 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.256964922 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.257038116 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.257090092 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.257112980 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.258049011 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.258071899 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.258130074 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.258153915 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.258176088 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.258232117 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.258263111 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.258270979 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.258970022 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.258992910 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.259012938 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.259088993 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.259098053 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.259131908 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.259349108 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.259850979 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.259885073 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.259960890 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.259991884 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.260020971 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.260054111 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.260073900 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.260078907 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.260857105 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.260889053 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.260917902 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.260947943 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.261109114 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.261128902 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.450459003 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.614528894 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.614864111 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.762409925 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.762447119 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.762463093 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.762531996 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.762706041 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.762732983 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.782298088 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.782320976 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.782340050 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.782357931 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.782361984 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.782407999 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.783256054 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.783314943 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.783314943 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.783360958 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.783430099 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.783474922 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.783597946 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.783616066 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.783674002 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.784239054 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.784255981 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.784296036 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.784348965 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.784351110 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.784368992 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.784399986 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.784420967 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.784461975 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.784463882 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.784554005 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.784564972 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.784579992 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.784615993 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.784629107 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.786166906 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.786185026 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.786201954 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.786232948 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.786266088 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.786289930 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.786351919 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.787045002 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.787127018 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.787164927 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.787182093 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.787198067 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.787214041 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.787266016 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.787275076 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.787276030 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.787333965 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.788177013 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.788196087 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.788242102 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.788275003 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.788338900 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.788346052 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.788391113 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.789160013 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.789180040 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.789228916 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.789232016 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.789263010 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.789313078 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.789320946 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.789377928 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.790172100 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.790189981 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.790205002 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.790239096 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.790273905 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.790290117 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.790326118 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.791279078 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.791348934 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.791363001 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.791369915 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.791426897 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.791446924 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.791460037 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.791467905 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.791512966 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:40.792287111 CEST	59044	49733	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:40.792357922 CEST	49733	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:44.710510969 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:44.963865995 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:44.964020014 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:44.974754095 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:45.255923986 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:45.310311079 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:45.363903046 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:45.364020109 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:45.611325979 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:45.611455917 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:45.868829966 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:45.870486021 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.183002949 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.272834063 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.272881031 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.272897959 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.273097992 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.279737949 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.279782057 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.279795885 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.279807091 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.279833078 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.279853106 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.280711889 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.280747890 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.280761957 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.280823946 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.280859947 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.357248068 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.529860973 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.529912949 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.529933929 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.529953003 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.530081034 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.530117989 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.530652046 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.530684948 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.530756950 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.530807018 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.536828041 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.536861897 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.536881924 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.536911011 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.536927938 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.536930084 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.536947966 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.537106037 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.537638903 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.537692070 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.537729025 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.537734985 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.537741899 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.537776947 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.537781000 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.537818909 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.538741112 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.538805962 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.538815975 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.538857937 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.538861990 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.538899899 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.538901091 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.538949013 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.539619923 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.539673090 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.641452074 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.781685114 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.781727076 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.781750917 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.781770945 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.781892061 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.781950951 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.782701969 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.782738924 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.782763958 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.782813072 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.782823086 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.782838106 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.782881975 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.783637047 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.783673048 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.783696890 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.783720016 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.783732891 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.783747911 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.783761978 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.783816099 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.784593105 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.784642935 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.784665108 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.784687042 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.784722090 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.784755945 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.784832954 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.789577007 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.789618015 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.789633989 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.789658070 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.789681911 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.789709091 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.789731979 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.789762974 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.789815903 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.790352106 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.790401936 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.790426970 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.790448904 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.790476084 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.790493011 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.790524960 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.790632963 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.790687084 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.790853024 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.790880919 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.790946007 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.790971041 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.790997028 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.791045904 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.791625023 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.791717052 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.791744947 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.791769028 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:46.791781902 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:46.791816950 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.141891003 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.141961098 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.356885910 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.412367105 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.412406921 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.412431955 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.412456989 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.412461042 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.412499905 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.413666964 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.413770914 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.419259071 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.419296026 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.419320107 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.419333935 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.419348955 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.419359922 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.419375896 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.419387102 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.419399977 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.419423103 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.419459105 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.419475079 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.419513941 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.420171976 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.420207024 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.420226097 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.420232058 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.420250893 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.420279026 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.420319080 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.420361996 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.421173096 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.421209097 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.421222925 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.421248913 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.421251059 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.421277046 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.421289921 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.421304941 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.421318054 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.421344995 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.422149897 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.422183990 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.422203064 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.422208071 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.422230005 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.422251940 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.422264099 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.422290087 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.422307968 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.422329903 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.423131943 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.423162937 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.423175097 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.423190117 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.423202991 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.423227072 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.423255920 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.423299074 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.423346043 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.423387051 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.424190044 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.424223900 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.424242973 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.424263954 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.424276114 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.424289942 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.424307108 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.424316883 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.424334049 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.424360037 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.425256014 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.425292015 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.425308943 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.425318003 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.425331116 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.425355911 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.425400972 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.425425053 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.425442934 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.425518990 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.426265955 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.426317930 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.426397085 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.426439047 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.426474094 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.426513910 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.426544905 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.426588058 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.427333117 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.427386999 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.427388906 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.427414894 CEST	59044	49734	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:47.427428007 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:47.427454948 CEST	49734	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:51.484848976 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:51.754668951 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:51.755466938 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:51.756158113 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:52.356836081 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:52.754228115 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:52.754435062 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:52.942643881 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:52.942882061 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:53.044843912 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:53.045097113 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:53.241306067 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:53.241456985 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:53.491540909 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:53.491794109 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:53.774890900 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:53.774998903 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:54.098759890 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.151252031 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.151279926 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.151295900 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.151357889 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:54.151370049 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.151438951 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:54.357708931 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:54.411204100 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.411235094 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.411252022 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.411269903 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.411355019 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:54.411416054 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:54.412344933 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.412368059 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.412415981 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.412429094 CEST	59044	49736	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:54.412548065 CEST	49736	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:58.469978094 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:58.721570969 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:58.721759081 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:58.722742081 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:59.021635056 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:59.154649019 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:59.156945944 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:59.438723087 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:59.439007998 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:31:59.724061012 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:31:59.724236965 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.022032022 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.091722012 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.091787100 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.091829062 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.091852903 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.091867924 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.091917992 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.092540026 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.092592001 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.092628002 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.092654943 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.092664003 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.092700005 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.092720985 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.093616009 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.093682051 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.361918926 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364707947 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364733934 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364747047 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364764929 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364784002 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364801884 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364814997 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.364820004 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364837885 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364856005 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364872932 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364893913 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364896059 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.364912987 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364928961 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364950895 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364953041 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.364973068 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.364980936 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.364994049 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.365019083 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.365772963 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.365793943 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.365811110 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.365812063 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.365859032 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.420661926 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.612066031 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.612106085 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.612124920 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.612149000 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.612250090 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.612344980 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.612821102 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.612848043 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.612869024 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.612891912 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.612912893 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.612958908 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.613723040 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.613745928 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.613768101 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.613790989 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.613812923 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.613837004 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.613877058 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.613931894 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.615286112 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.615400076 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.615427017 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.615499020 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.618839979 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.618892908 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.618921995 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.618946075 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.618952990 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.618985891 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.619003057 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.619111061 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.620004892 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.620134115 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.620170116 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.620189905 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.620234966 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.620235920 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.620327950 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.620817900 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.620877028 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.620923042 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.620982885 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.621026039 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.621078014 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.621104956 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.621149063 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.621155024 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.621211052 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.621809006 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.621862888 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.621901035 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.621944904 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.621968985 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.621973991 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.622068882 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.631158113 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.631187916 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.631205082 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.631222963 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.631237030 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.631239891 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.631261110 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.631270885 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.631283045 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.631330967 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.935590982 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:00.958462954 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:00.958609104 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.145991087 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.146209002 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.172082901 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.172142982 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.172188044 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.172229052 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.172272921 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.172347069 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.172997952 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.173049927 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.173067093 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.173091888 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.173094988 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.173149109 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.173212051 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.173268080 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.173949003 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.173991919 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.174010038 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.174025059 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.174031019 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.174076080 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.179138899 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.179193020 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.179244995 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.179279089 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.179341078 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.179388046 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.179414988 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.179430008 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.179434061 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.179486990 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.180147886 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.180191040 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.180227995 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.180255890 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.180344105 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.180385113 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.180397987 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.180429935 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.181118965 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.181164026 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.181194067 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.181225061 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.181299925 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.181341887 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.181363106 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.181375027 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.181379080 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.181451082 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.182005882 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.182050943 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.182075024 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.182122946 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.183051109 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.183095932 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.183125973 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.183134079 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.183159113 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.183180094 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.183259964 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.183310986 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.184087992 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.184134007 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.184158087 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.184171915 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.184191942 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.184209108 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.184221029 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.184264898 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.184355021 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.185067892 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.185110092 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.185146093 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.185250998 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.185254097 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.185297012 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.185302019 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.185340881 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.186032057 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.186080933 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.186115980 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.186117887 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.186160088 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.186168909 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.186212063 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.186217070 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.186245918 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.187213898 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.187258959 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.187335014 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.221376896 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.391732931 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.405563116 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.422027111 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.422100067 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.422138929 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.422168016 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.422357082 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.422415018 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.423185110 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.423211098 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.423226118 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.423239946 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.423382998 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.424005985 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.424027920 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.424114943 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.424160957 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.424241066 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.461283922 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.461318970 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.461337090 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.461353064 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.461390018 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.461509943 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.462095976 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.462117910 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.462229967 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.462249041 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.462477922 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.463090897 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.463210106 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.463282108 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.463304043 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.463320017 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.463336945 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.463386059 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.463458061 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.464103937 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.464128971 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.464147091 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.464164019 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.464195967 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.464318037 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.464476109 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.465145111 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.465173006 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.465233088 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.465290070 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.465302944 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.465306044 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.465368986 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.465413094 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.466315985 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.466358900 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.466408968 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.466465950 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.466480017 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.466510057 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.466573954 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.467185974 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.467211962 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.467228889 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.467263937 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.467281103 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.467336893 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.467408895 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.468209028 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.468230963 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.468274117 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.468291998 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.468307972 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.468350887 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:01.469079971 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.469115019 CEST	59044	49737	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:01.469213009 CEST	49737	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:05.516690969 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:05.905499935 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:05.905663013 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:05.906274080 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:06.204624891 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:06.304272890 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:06.304728031 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:06.591231108 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:06.591348886 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:06.971628904 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:06.971714020 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.264436007 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.332113981 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.338998079 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.339060068 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.339099884 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.339138985 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.339169979 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.339179039 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.339205980 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.339596033 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.340200901 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.340245008 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.340282917 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.340320110 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.340353012 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.340370893 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.458703995 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.601308107 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.601336956 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.601351023 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.601366997 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.601492882 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.602163076 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.602202892 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.602231026 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.602256060 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.602279902 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.602329016 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.602371931 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.603188992 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.603219032 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.603247881 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.603272915 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.603295088 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.603296041 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.603332996 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.603367090 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.604166031 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.604243040 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.604406118 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.604432106 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.604497910 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.604526043 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.605302095 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.605365992 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.609740973 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.752002954 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.859236956 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.859273911 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.859297037 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.859318018 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.859338045 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.859370947 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.860157967 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.860196114 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.860255957 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.860281944 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.860307932 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.860318899 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.861088037 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.861124992 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.861305952 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.861336946 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.861360073 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.861396074 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.862066031 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.862104893 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.862257004 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.862282991 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.862308979 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.862318993 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.862368107 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.863292933 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.863327980 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.863348961 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.863385916 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.863411903 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.863425970 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.866889000 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.866930008 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.867026091 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.867084026 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.867096901 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.867100954 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.867141008 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.867187023 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.867603064 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.867641926 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.867681026 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.867714882 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.867724895 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.867826939 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.868195057 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.868235111 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.868271112 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.868288040 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.868305922 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.868367910 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.868953943 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.869138002 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.869508028 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.869544029 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.869582891 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.869610071 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:07.869621038 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:07.872157097 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.211801052 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.211838961 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.211854935 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.211869955 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.211968899 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.212013960 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.212471008 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.212496996 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.212508917 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.212555885 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.212558031 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.212577105 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.213365078 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.213413954 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.213438988 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.213448048 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.213471889 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.213493109 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.213505983 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.213540077 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.214422941 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.214448929 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.214468956 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.214498997 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.214524984 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.214570045 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.215399027 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.215425014 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.215441942 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.215459108 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.215466976 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.215502977 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.216363907 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.216433048 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.216453075 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.216468096 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.216481924 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.216506958 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.216531038 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.217444897 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.217468023 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.217485905 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.217503071 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.217525005 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.217581987 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.218388081 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.218436956 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.218456984 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.218468904 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.218511105 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.218524933 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.218529940 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.218573093 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.219451904 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.219477892 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.219495058 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.219511032 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.219547033 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.219587088 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.220376015 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.220400095 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.220470905 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.220488071 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.220505953 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.220551968 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.221378088 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.221438885 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.221457958 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.221525908 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.221596956 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.221613884 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.221659899 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.222512007 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.222542048 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.222589970 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.264540911 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.426685095 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.453181982 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.453233004 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.453279972 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.453310013 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.453310966 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.453356028 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.453371048 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.453408003 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.454067945 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.454108953 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.454152107 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.454169035 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.459036112 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.459090948 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.459131956 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.459170103 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.459183931 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.459192991 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.459197998 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.459209919 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.459217072 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.459261894 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.460103989 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.460149050 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.460175037 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.460190058 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.460212946 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.460238934 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.460242033 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.460284948 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.460302114 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.460410118 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.466262102 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.466306925 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.466344118 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.466363907 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.466382027 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.466415882 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.466458082 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.491355896 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.491394043 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.491415977 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.491436005 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.491452932 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.491492987 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.491533041 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.491539955 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.492347002 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.492367983 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.492402077 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.492413044 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.492427111 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.492439985 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.492460966 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.492491007 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.493345022 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.493372917 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.493407965 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.493410110 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.493428946 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.493432045 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.493453979 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.493455887 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.493489027 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.493499994 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.494393110 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.494453907 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.494469881 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.494496107 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.494537115 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.494537115 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.494554043 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.494585991 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.494596958 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.494640112 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.495609999 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.495655060 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.495692968 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.495719910 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.495732069 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.495743990 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.495748997 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.495778084 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.495790958 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.495830059 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.496292114 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.496360064 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.496500969 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.496545076 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.496558905 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.496589899 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:08.499377966 CEST	59044	49738	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:08.499524117 CEST	49738	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:12.544053078 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:12.941435099 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:12.942125082 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:12.942152977 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:13.731941938 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:13.734931946 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:13.954318047 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:13.954504967 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.025753975 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.025947094 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.278408051 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.280057907 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.614679098 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.617285967 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.681265116 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.681339979 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.688366890 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.688390017 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.688410044 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.688432932 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.688455105 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.688555956 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.688569069 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.689369917 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.689457893 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.689475060 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.689480066 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.689505100 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.689523935 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.689585924 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.904802084 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.932084084 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.932123899 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.932145119 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.932168961 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.932276011 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.933409929 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.939706087 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.939738035 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.939750910 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.939766884 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.939783096 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.939867020 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.939877987 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.941047907 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.941075087 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.941133022 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.941189051 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.941335917 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.941365004 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.946316004 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.946347952 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.946363926 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.946381092 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.946400881 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.946419001 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.946429014 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.946985006 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.947011948 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:14.947019100 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:14.948322058 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.212846994 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.212884903 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.212903023 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.212918043 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.212934017 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.213023901 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.213860035 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.213886976 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.213901997 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.213957071 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.213974953 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.213990927 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.214694023 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.214736938 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.214745045 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.214751959 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.214787960 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.214806080 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.214826107 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.214865923 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.214909077 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.215226889 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.215285063 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.215327024 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.215369940 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.215387106 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.215419054 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216201067 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216222048 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216238976 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216238976 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.216252089 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.216281891 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.216320038 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216340065 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216393948 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.216738939 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216770887 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216825008 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.216829062 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216877937 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216897964 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.216917992 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.217451096 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.217503071 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.217540026 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.217556953 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.217624903 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.217659950 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.217679024 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.218497038 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.218519926 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.218538046 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.218624115 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.218641043 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.218657017 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.218660116 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.219448090 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.219472885 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.220350027 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.463401079 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.463421106 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.463555098 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.463573933 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.463577986 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.463809013 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.464246988 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.464277983 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.464293003 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.464313030 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.464329958 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.464349031 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.464375973 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.464883089 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.464903116 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.464937925 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.469011068 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.469028950 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.469044924 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.469060898 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.469101906 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.469105959 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.469119072 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.469145060 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.469763994 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.469926119 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.470204115 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.470222950 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.470240116 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.470274925 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.470298052 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.470870972 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.470976114 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.471021891 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.471044064 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.471231937 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.476231098 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.476253033 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.476268053 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.476286888 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.476291895 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.476310015 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.476315022 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.476331949 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.476361990 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.483087063 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.483225107 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.483356953 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.483449936 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.483468056 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.483474016 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.483511925 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.483537912 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.483972073 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.483992100 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.484008074 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.484021902 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.484061956 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.484112978 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.484141111 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.484210014 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.484219074 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.485270977 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.485297918 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.485313892 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.485332012 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.485340118 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.485344887 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.485423088 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.485433102 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.486124992 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.486146927 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.486171007 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.486200094 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.486232996 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.486270905 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.486275911 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.486277103 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.486351013 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.486979008 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.487068892 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.831593990 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.832292080 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.900245905 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.900269032 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.900284052 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.900305033 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.900310993 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.900322914 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.900362015 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.900401115 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.901153088 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.901179075 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.901216030 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.901233912 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.901242971 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.901288033 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.901324034 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.901346922 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.901369095 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.901400089 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.901424885 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.901441097 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.901549101 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.901570082 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.901606083 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.901667118 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.901716948 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.901946068 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.902928114 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.910424948 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.910455942 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.910474062 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.910490990 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.910507917 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.910523891 CEST	59044	49741	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:15.910562038 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:15.910609961 CEST	49741	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:19.611149073 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:19.884941101 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:19.885226011 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:19.885617018 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:20.221452951 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.312340021 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.314044952 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:20.562565088 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.563314915 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:20.855432987 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.967310905 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.967345953 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.967371941 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.967396021 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.967418909 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.967473984 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:20.967504025 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:20.967992067 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.968025923 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.968050003 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.968102932 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:20.968117952 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:20.968142986 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.968168020 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:20.969027042 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:21.712055922 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.712083101 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.712099075 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.712115049 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.712876081 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.712901115 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.712925911 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:21.712958097 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:21.712974072 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.713099003 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.713145971 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:21.714092970 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.714128971 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.714144945 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.714185953 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:21.714200020 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.714221001 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.714617968 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:21.714876890 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.714945078 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:21.715028048 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.715054035 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.715070009 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.715590000 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:21.716114998 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.716137886 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.716161966 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:21.716173887 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:21.716871023 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.452838898 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.452868938 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.453008890 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.453038931 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.453140020 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.453164101 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.453586102 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.453623056 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.453646898 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.453674078 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.453699112 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.453882933 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.454274893 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.454308033 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.454328060 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.454361916 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.454381943 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.454411983 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.460552931 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.460583925 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.460601091 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.460622072 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.460639000 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.460654974 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.460671902 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.460680962 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.460704088 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.460731030 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.460747957 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.460808039 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.460813999 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.460814953 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.462879896 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.462893963 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.462912083 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.462929010 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.462945938 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.463133097 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.463148117 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.463746071 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.463814020 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.463903904 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.464215040 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.464234114 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.464296103 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.464344978 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.465492964 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.465522051 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.465542078 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.465560913 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.465584040 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.465612888 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.467098951 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.467252016 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.469898939 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.469924927 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.470984936 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.691772938 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.691806078 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.691824913 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.691845894 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.691868067 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.691979885 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.692043066 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.692076921 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.692115068 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.692138910 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.692372084 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.700714111 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.700747967 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.700767040 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.700798988 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.701031923 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.701620102 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.701649904 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.701677084 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.701704979 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.701736927 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.701766014 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.701838017 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.701919079 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.701952934 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.701991081 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.702116966 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.732922077 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.732955933 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.732971907 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.732990980 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.733007908 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.733165979 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.737478018 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737504005 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737515926 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737529993 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737546921 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737559080 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737570047 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737582922 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737600088 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737616062 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737632990 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737634897 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.737644911 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737658978 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737675905 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737692118 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737700939 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.737708092 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737728119 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737745047 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737757921 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.737761974 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737780094 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737792015 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737803936 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737816095 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737828970 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:22.737848043 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.738054991 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:22.781193018 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.351986885 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.352097034 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.373720884 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.373775959 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.373874903 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.373927116 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.373965979 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.374152899 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.374336004 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.374375105 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.374402046 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.374428988 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.374488115 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.374492884 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.374541044 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.375087976 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.375132084 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.375169039 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.375286102 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.375343084 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.375391006 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.375514984 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.376049042 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.376096964 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.376143932 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.376183987 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.376221895 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.376257896 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.376327038 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.377137899 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.377183914 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.377244949 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.377254963 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.377309084 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.377315998 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.377361059 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.377475023 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.377839088 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.377897978 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.377953053 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.378005028 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.378010035 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.378055096 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.378127098 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.378424883 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.378518105 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.378593922 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.378653049 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.378707886 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.378741026 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.378812075 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.378978014 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.379282951 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.379363060 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.379419088 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.379475117 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.379487991 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.379549026 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.379550934 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.379873991 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.379952908 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.380007982 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.380088091 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.380150080 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.380201101 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.380207062 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.380290031 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.380917072 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.380974054 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.381057024 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.381088018 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.381112099 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.381165028 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.381198883 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.421845913 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.651912928 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.651969910 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.652029037 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.652031898 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.652055025 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.652152061 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.652853966 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.652923107 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.652951002 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.652972937 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.653004885 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.653031111 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.659075975 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.659132004 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.659162998 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.659229040 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.666239023 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.666281939 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.666316032 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.666321039 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.666367054 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.666377068 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.666392088 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.666492939 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.675088882 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675143957 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675170898 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675194979 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675211906 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.675219059 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675244093 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675266981 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.675297976 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.675318956 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675472975 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675549030 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.675678968 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675712109 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675785065 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.675826073 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.675988913 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.676078081 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.676110029 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.676400900 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.676477909 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.676698923 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.676822901 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.676903009 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.676990986 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.677151918 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.677195072 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.677227974 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.677443981 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.677516937 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.677560091 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.677624941 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.677723885 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.677834034 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.677947998 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.678015947 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.678240061 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.678348064 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.678400040 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.678425074 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.678596973 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.678661108 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.678733110 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.679002047 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.679089069 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.679176092 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.679267883 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.679341078 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.679703951 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.734426975 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.901432991 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.901484013 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.901510954 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.901532888 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.901602983 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.902250051 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.902275085 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.902345896 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.902376890 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.902932882 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.903024912 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.903450966 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.908431053 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.908471107 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.908535004 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.908559084 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.908581972 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.908597946 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.908696890 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.918659925 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.918734074 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.918771982 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.918879032 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.925745964 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.925815105 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.925868988 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.925872087 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.925915956 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.925992966 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.926616907 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.926671028 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.926781893 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.933168888 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.933219910 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.933259964 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.933335066 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.933407068 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.953774929 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.958951950 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.959002972 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.959054947 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.959110022 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.959120989 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.959152937 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.959173918 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.959300995 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.960253954 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.960335016 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.960443974 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.960491896 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.960534096 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.960607052 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.969362020 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.969443083 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.969482899 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.969520092 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.969558954 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.969568014 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.969604969 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.969630003 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.969652891 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.969655037 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.969769955 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.969810009 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.969829082 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.970026970 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.970088005 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.970139027 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.970180988 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:23.970231056 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:23.984067917 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:24.031272888 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:24.153290033 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:24.153345108 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:24.153357029 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:24.153531075 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:24.389040947 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:24.678661108 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:25.131212950 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:25.143743038 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:25.501945019 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:25.502962112 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:25.656404018 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:25.912262917 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:25.914128065 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:26.098303080 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:26.098325968 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:26.098469019 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:26.141112089 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:26.162086964 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:26.372720003 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:26.373028994 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:26.614505053 CEST	59044	49742	172.94.38.41	192.168.2.5
Apr 12, 2021 08:32:26.614821911 CEST	49742	59044	192.168.2.5	172.94.38.41
Apr 12, 2021 08:32:26.941507101 CEST	59044	49742	172.94.38.41	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 12, 2021 08:30:08.134051085 CEST	49557	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:08.191258907 CEST	53	49557	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:08.421972990 CEST	61733	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:08.482515097 CEST	53	61733	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:09.466720104 CEST	65447	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:09.526801109 CEST	53	65447	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:10.401020050 CEST	52441	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:10.454765081 CEST	53	52441	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:11.337688923 CEST	62176	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:11.389236927 CEST	53	62176	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:13.228276968 CEST	59596	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:13.276958942 CEST	53	59596	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:14.407341003 CEST	65296	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:14.459477901 CEST	53	65296	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:22.583833933 CEST	63183	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:22.640877008 CEST	53	63183	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:23.825819016 CEST	60151	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:23.874715090 CEST	53	60151	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:25.860424042 CEST	56969	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:25.912151098 CEST	53	56969	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:31.771228075 CEST	55161	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:31.829932928 CEST	53	55161	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:37.482243061 CEST	54757	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:37.548027039 CEST	53	54757	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:40.968626976 CEST	49992	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:41.017292023 CEST	53	49992	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:44.702049971 CEST	60075	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:44.762339115 CEST	53	60075	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:52.186739922 CEST	55016	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:52.243825912 CEST	53	55016	8.8.8.8	192.168.2.5
Apr 12, 2021 08:30:58.794589043 CEST	64345	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:30:58.856391907 CEST	53	64345	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:03.357353926 CEST	57128	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:03.414283037 CEST	53	57128	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:05.804575920 CEST	54791	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:05.862010002 CEST	53	54791	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:16.566315889 CEST	50463	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:16.626246929 CEST	53	50463	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:20.737910032 CEST	50394	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:20.786770105 CEST	53	50394	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:23.508275032 CEST	58530	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:23.567409039 CEST	53	58530	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:27.593275070 CEST	53813	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:27.654072046 CEST	53	53813	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:30.861699104 CEST	63732	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:30.918889046 CEST	53	63732	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:37.636682987 CEST	57344	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:37.696932077 CEST	53	57344	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:44.652456045 CEST	54450	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:44.709273100 CEST	53	54450	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:48.820518970 CEST	59261	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:48.888473988 CEST	53	59261	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:51.424906015 CEST	57151	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:51.481864929 CEST	53	57151	8.8.8.8	192.168.2.5
Apr 12, 2021 08:31:58.417778969 CEST	59413	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:31:58.466454029 CEST	53	59413	8.8.8.8	192.168.2.5
Apr 12, 2021 08:32:05.455231905 CEST	60516	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:32:05.514679909 CEST	53	60516	8.8.8.8	192.168.2.5
Apr 12, 2021 08:32:07.785151005 CEST	51649	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:32:07.835719109 CEST	53	51649	8.8.8.8	192.168.2.5
Apr 12, 2021 08:32:10.577003956 CEST	65086	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:32:10.651922941 CEST	53	65086	8.8.8.8	192.168.2.5
Apr 12, 2021 08:32:12.474344015 CEST	56432	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:32:12.542119026 CEST	53	56432	8.8.8.8	192.168.2.5
Apr 12, 2021 08:32:19.553409100 CEST	52929	53	192.168.2.5	8.8.8.8
Apr 12, 2021 08:32:19.610555887 CEST	53	52929	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 12, 2021 08:30:37.482243061 CEST	192.168.2.5	8.8.8.8	0xcc94	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:30:44.702049971 CEST	192.168.2.5	8.8.8.8	0x98d0	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:30:52.186739922 CEST	192.168.2.5	8.8.8.8	0x42c3	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:30:58.794589043 CEST	192.168.2.5	8.8.8.8	0x9ad1	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:05.804575920 CEST	192.168.2.5	8.8.8.8	0xf8b7	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:16.566315889 CEST	192.168.2.5	8.8.8.8	0x276	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:23.508275032 CEST	192.168.2.5	8.8.8.8	0x534e	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:30.861699104 CEST	192.168.2.5	8.8.8.8	0x1f16	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:37.636682987 CEST	192.168.2.5	8.8.8.8	0x9350	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:44.652456045 CEST	192.168.2.5	8.8.8.8	0x93b6	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:51.424906015 CEST	192.168.2.5	8.8.8.8	0xaea6	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:58.417778969 CEST	192.168.2.5	8.8.8.8	0xdc36	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:32:05.455231905 CEST	192.168.2.5	8.8.8.8	0xb692	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:32:12.474344015 CEST	192.168.2.5	8.8.8.8	0x62ac	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)
Apr 12, 2021 08:32:19.553409100 CEST	192.168.2.5	8.8.8.8	0x7c97	Standard query (0)	uyeco.pw	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Apr 12, 2021 08:30:37.548027039 CEST	8.8.8.8	192.168.2.5	0xcc94	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:30:44.762339115 CEST	8.8.8.8	192.168.2.5	0x98d0	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:30:52.243825912 CEST	8.8.8.8	192.168.2.5	0x42c3	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:30:58.856391907 CEST	8.8.8.8	192.168.2.5	0x9ad1	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:05.862010002 CEST	8.8.8.8	192.168.2.5	0xf8b7	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:16.626246929 CEST	8.8.8.8	192.168.2.5	0x276	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:23.567409039 CEST	8.8.8.8	192.168.2.5	0x534e	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:30.918889046 CEST	8.8.8.8	192.168.2.5	0x1f16	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:37.696932077 CEST	8.8.8.8	192.168.2.5	0x9350	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:44.709273100 CEST	8.8.8.8	192.168.2.5	0x93b6	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:51.481864929 CEST	8.8.8.8	192.168.2.5	0xaea6	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:31:58.466454029 CEST	8.8.8.8	192.168.2.5	0xdc36	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:32:05.514679909 CEST	8.8.8.8	192.168.2.5	0xb692	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:32:12.542119026 CEST	8.8.8.8	192.168.2.5	0x62ac	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)
Apr 12, 2021 08:32:19.610555887 CEST	8.8.8.8	192.168.2.5	0x7c97	No error (0)	uyeco.pw	172.94.38.41	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 7lrH3syQoO.exe PID: 5960 Parent PID: 5808

General

Start time:	08:30:15
Start date:	12/04/2021
Path:	C:\Users\user\Desktop\7lrH3syQoO.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\7lrH3syQoO.exe'
Imagebase:	0x9b0000
File size:	672256 bytes
MD5 hash:	60C423711D537751BC90E037100AFF0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.273922733.0000000003E0D000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.273179000.0000000002D85000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: schtasks.exe PID: 6172 Parent PID: 5960

General

Start time:	08:30:30
Start date:	12/04/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\YwKZCbS' /XML 'C:\Users\user\AppData\Local\Temp\tmp6FAA.tmp'
Imagebase:	0x1360000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6180 Parent PID: 6172

General

Start time:	08:30:30
Start date:	12/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegSvcs.exe PID: 6260 Parent PID: 5960

General

Start time:	08:30:31
Start date:	12/04/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Imagebase:	0x6f0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.502485666.00000000029D1000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.508407731.0000000005B30000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.508407731.0000000005B30000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.506658685.0000000003A31000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000006.00000002.498272914.0000000000402000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000006.00000002.508737173.0000000005C60000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 7lrH3syQoO.exe PID: 5960 Parent PID: 5808 7lrH3syQoO.exeCOMMON

Executed Functions

Function 07793268, Relevance: 3.9, Strings: 3, Instructions: 164COMMON

Download Yara Rule

Strings

_'Z, xrefs: 07793383
X(/, xrefs: 077932B8
_'Z, xrefs: 07793391

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID: X(/$_'Z$_'Z
API String ID: 0-3853672407
Opcode ID: 3828a6db761452888e9e57333521ba39d85dcd3f02a5ff179d24f346d9155fe1
Instruction ID: 08c90967fd89d93c3ee4da9b9d307f10bd29e20c29c7c1594e2e9ed2e4d340eb
Opcode Fuzzy Hash: 3828a6db761452888e9e57333521ba39d85dcd3f02a5ff179d24f346d9155fe1
Instruction Fuzzy Hash: 6171F4B8D11208DFCB04DFA5E5895ADFFB2FB89301F20942AE816A7354DB305A46CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07793211, Relevance: 2.7, Strings: 2, Instructions: 174COMMON

Download Yara Rule

Strings

X(/, xrefs: 077932B8
_'Z, xrefs: 07793391

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID: X(/$_'Z
API String ID: 0-1066208152
Opcode ID: 4d9a7a5a076f6b19fc911b730e80a5870be8760899d98eefb5045e4fe1ad11ae
Instruction ID: eeb0c271d94436aaf9afb7aa62105d10d14e100ae991bebdf000fbbf6f55f0c0
Opcode Fuzzy Hash: 4d9a7a5a076f6b19fc911b730e80a5870be8760899d98eefb5045e4fe1ad11ae
Instruction Fuzzy Hash: 397104B8D11249DFCB04DFA4E5856ADBFB2FB89301F20956AE816A7354DB305A46CF00

Uniqueness

Uniqueness Score: -1.00%

Function 07793258, Relevance: 2.7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

Strings

X(/, xrefs: 077932B8
_'Z, xrefs: 07793391

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID: X(/$_'Z
API String ID: 0-1066208152
Opcode ID: 967ae7fc499ad12e148da8ce70bc4f2e236925c5476a5a58507c407670e1438c
Instruction ID: 3ce21a645282574010c1af760dd56683e1865ded991eeb7a2706c26daa9ca809
Opcode Fuzzy Hash: 967ae7fc499ad12e148da8ce70bc4f2e236925c5476a5a58507c407670e1438c
Instruction Fuzzy Hash: 1C71F7B8D11249DFCB04DFA5E5896ADBFB2FF89301F20942AE816A7354DB305A46CF11

Uniqueness

Uniqueness Score: -1.00%

Function 07799FE0, Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

8SJ, xrefs: 0779A026
1GqM, xrefs: 0779A08A

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID: 1GqM$8SJ
API String ID: 0-2152825903
Opcode ID: 71a14ffee6783a0029ef2d292813a1714ff23f489e0a0c04effe2b428397722e
Instruction ID: 6ceca861c2b9e14c8d0d1e7a948cdd5b4d788aa84bccb2b593101736e266829e
Opcode Fuzzy Hash: 71a14ffee6783a0029ef2d292813a1714ff23f489e0a0c04effe2b428397722e
Instruction Fuzzy Hash: BF514B74E16218DBCF48CFA5E9415DDFBB2FB8E250F15E42AD406B7254EB349901CB28

Uniqueness

Uniqueness Score: -1.00%

Function 0779E868, Relevance: 1.9, Strings: 1, Instructions: 635COMMON

Download Yara Rule

Strings

v, xrefs: 0779EC74

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID: v
API String ID: 0-1801730948
Opcode ID: 56b00099cd45980a2443b5ce33399e3987d56cecb0d523d98999bf040b78d931
Instruction ID: f5f4d16017d9c1970790b1904bfbe712ca91c3ece1c3f6f544619a6cf61d4e4c
Opcode Fuzzy Hash: 56b00099cd45980a2443b5ce33399e3987d56cecb0d523d98999bf040b78d931
Instruction Fuzzy Hash: 4B32CCB2B022058FDB29DB69D454BAEB7F6AF89740F144879E106DB3A0DB71EC01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07794609, Relevance: 1.6, APIs: 1, Instructions: 58nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 0779468F

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: fe7e50b0f8783988e9c15b7f9477c7148a619a25a3502c65e91d9d5d89d4de4b
Instruction ID: 23780dbaab8758c04fe6c664de82dab744aa541567bf354458face8086f01fac
Opcode Fuzzy Hash: fe7e50b0f8783988e9c15b7f9477c7148a619a25a3502c65e91d9d5d89d4de4b
Instruction Fuzzy Hash: C821D0B5D016599FCB10CF9AD884ADEBBF4FB4C314F108429E918A7250D374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07794610, Relevance: 1.6, APIs: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 0779468F

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 9b7a464bbd8735c1ca9d35bfaaf443c576c1dc161717e37a96754f4e4ed5393d
Instruction ID: 1fd0df82a5b31630e0c9c88bf3a7292d4417932f5a0c22ef71654cd08477b3ce
Opcode Fuzzy Hash: 9b7a464bbd8735c1ca9d35bfaaf443c576c1dc161717e37a96754f4e4ed5393d
Instruction Fuzzy Hash: 3621C0B5D016599FCB10CF9AD884ADEBBF4FB48314F10842AE958A7310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07795D9F, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a21715982573ab34c209cd7487b222902c731822a5812d2724f9a2fe306be2c
Instruction ID: 4f6c659a794c48cd6631ea84cb9b0cdf3c4b7dd1516494e73a9ecae74fc90309
Opcode Fuzzy Hash: 9a21715982573ab34c209cd7487b222902c731822a5812d2724f9a2fe306be2c
Instruction Fuzzy Hash: AFB188B4E16228CFCF15CFA4E9846ECBBB1FB4A340F10856AD00ABB281DB345951CF20

Uniqueness

Uniqueness Score: -1.00%

Function 07795D86, Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc59883acb18491b4e82901e1ee154e9e43b4ec76c1c3c4231ac28658c402fa9
Instruction ID: aa573674d95c9d7e7abbf2365ea1083ba739673c516c239bd5529bdef47e8f85
Opcode Fuzzy Hash: fc59883acb18491b4e82901e1ee154e9e43b4ec76c1c3c4231ac28658c402fa9
Instruction Fuzzy Hash: 1AB156B4D16218CFCF15CFA4E9856ECBBB1FB4A340F10996AD00ABB295DB345951CF24

Uniqueness

Uniqueness Score: -1.00%

Function 07795DE8, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef2ad9e3dca0133933e1fbb405cc8e4cd3c36f937819fe53a7ecf0fa0654739
Instruction ID: a69705fc22c14f2c91142b492e2ec3bfe302dc85601dd7b1727c7153ebd4da90
Opcode Fuzzy Hash: 1ef2ad9e3dca0133933e1fbb405cc8e4cd3c36f937819fe53a7ecf0fa0654739
Instruction Fuzzy Hash: 0AB133B4D16218CFCF14DFA4E9846EDBBB2FB8A340F10996AD40ABB254DB355941CF24

Uniqueness

Uniqueness Score: -1.00%

Function 07790B63, Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac8e280551f8d1fc70ccef7532b57f565a07f8299cc293fc7447428e87771de
Instruction ID: 9e0d6ba673654b13521316352d2b0c96923763186544b5000167a3afca05cf68
Opcode Fuzzy Hash: 1ac8e280551f8d1fc70ccef7532b57f565a07f8299cc293fc7447428e87771de
Instruction Fuzzy Hash: E6714FB2E126558BDF19CF2AEC447D9BBF3AFC6254F14C0BAC4489A215D7301592DF40

Uniqueness

Uniqueness Score: -1.00%

Function 07794708, Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7c63f187ee85abd0caa08233c423af8ef5c7402c4d100fa7f9c254e95657e5
Instruction ID: aa8ee77bf034210f0e7b2ac09f21fd6808e89bee7c9b9abadb6562d32354ebb9
Opcode Fuzzy Hash: 4b7c63f187ee85abd0caa08233c423af8ef5c7402c4d100fa7f9c254e95657e5
Instruction Fuzzy Hash: 19914DF4E051599BCB14DFA9D68046EFBB6FF8A204F24C169D414A7346D730AD42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0779ADE8, Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ef3ef61a15f1ab43d1245173bce499293cb3fe6bc2ec1d64c67791d225b7dde
Instruction ID: 6d94a482a72f3312f494cd4b3c4afd20d9ae50ac4d409dfc4f7a101e8ab59627
Opcode Fuzzy Hash: 4ef3ef61a15f1ab43d1245173bce499293cb3fe6bc2ec1d64c67791d225b7dde
Instruction Fuzzy Hash: F681C4B4E112199FCF04DFA5E8455AEFBB2FF89340F20912AE816AB358DB345901CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0779BC68, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9722ddc61b62fd5d992a95390b26f4aebfbd51525f823c506db0611b344d3ff
Instruction ID: ffc350107f068cdcde0cea498b9596d9b3dc6671751e1065bae58728eabca298
Opcode Fuzzy Hash: e9722ddc61b62fd5d992a95390b26f4aebfbd51525f823c506db0611b344d3ff
Instruction Fuzzy Hash: C37158B1E15229CBDB28CF66E844BD9B7B6BB89340F10C5BAD50DA7250EB705A81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 07790C18, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68139542cca0acd6fc124d11ec8a823aaac7220baa6251430e7559f9a6c4a9d7
Instruction ID: 4163f6f2fc7c10c271e46b5d897281722d6d9cebe470e0c4bdf66cca54b2c108
Opcode Fuzzy Hash: 68139542cca0acd6fc124d11ec8a823aaac7220baa6251430e7559f9a6c4a9d7
Instruction Fuzzy Hash: 1F416EB5E156598BDB18DF6BCD4528EFBF3BFC9300F14C1BA850CA6214DB300A858E51

Uniqueness

Uniqueness Score: -1.00%

Function 07790040, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae28f7557866ca64559f92013849593f0dae228f824d033260abdb1f54aeaa4
Instruction ID: 75d7a79ca75572c1598e8488c0bd38913ed0c221623f89ad5b5f08136b98991e
Opcode Fuzzy Hash: 3ae28f7557866ca64559f92013849593f0dae228f824d033260abdb1f54aeaa4
Instruction Fuzzy Hash: CD21B9B1E116199BEB58CF6BDC4069EFBF7AFC9200F04C17AC508A6224EB301956CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0779E068, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef3d25824276c526b5aeb0e1a3e7cb9bcf58c4fa61ec16a6871679133efc810
Instruction ID: 27db8597672a1234518f3a47bbac143a7969fc70f126b4d57f20c2497ee4d649
Opcode Fuzzy Hash: 2ef3d25824276c526b5aeb0e1a3e7cb9bcf58c4fa61ec16a6871679133efc810
Instruction Fuzzy Hash: A21136B1D05219CFDB14CFA9D4497EEBAF0AB4E351F24946AD041B3290CBB48984CB69

Uniqueness

Uniqueness Score: -1.00%

Function 07798C9C, Relevance: 1.7, APIs: 1, Instructions: 249processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07798EDE

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4cf636728d68d6a7b5256773030de99544ebb21a9a6f9dc077ff9d9edbd993c8
Instruction ID: e944b22706e7f3901e5f4edf0dc7c052309785a23fabb1f5e3a84d92ad0b83a2
Opcode Fuzzy Hash: 4cf636728d68d6a7b5256773030de99544ebb21a9a6f9dc077ff9d9edbd993c8
Instruction Fuzzy Hash: ECA17BB1D01219CFDF10CF68D8807EEBBB2BF59354F148569E819A7280EB749985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07798CA8, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07798EDE

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: aaee4e6431e42cac8c5c2fcda85a1a380fa52a712162dd037a9748aa0924b227
Instruction ID: 3b717c1eb56e71616144c5beffbf2a54f9affb282f5ec03072a8f1e0a0628bdc
Opcode Fuzzy Hash: aaee4e6431e42cac8c5c2fcda85a1a380fa52a712162dd037a9748aa0924b227
Instruction Fuzzy Hash: 87917BB1D01259CFDF10CF68D880BDEBBB2BF59354F148569E809A7280EB749985CF92

Uniqueness

Uniqueness Score: -1.00%

Function 07798A18, Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07798AB0

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 756e2e8ff4b2b17cd6f4bae56baf7a4e5f5d6ad16508f682a957505d1156d623
Instruction ID: 05df426cb4fd248087ce267842fa57558a109e829fb9d449b84ed53daf9c566a
Opcode Fuzzy Hash: 756e2e8ff4b2b17cd6f4bae56baf7a4e5f5d6ad16508f682a957505d1156d623
Instruction Fuzzy Hash: 5B2124B29003499FCF10CFA9D8847EEBBB5FF48354F00842AE918A7340D7789944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07798A20, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07798AB0

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 024fd5bbbf02233b38d33f6a5826269d10ee9d8b85ddfab53bb481789cf9ea46
Instruction ID: 68c1c9723cbe5aacb08b33851930be845880d061fff7e36cab3dfdd78d4a338e
Opcode Fuzzy Hash: 024fd5bbbf02233b38d33f6a5826269d10ee9d8b85ddfab53bb481789cf9ea46
Instruction Fuzzy Hash: 2E2102B19003499FCF10CFA9D884BEEBBB5FB48354F00842AE918A7340D7789944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07798B08, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07798B90

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f9bb4f0f7e5ed51cff6d742e1ecc16d7888a3fe4b78942494a6789a14b7f125b
Instruction ID: 9a4e387b109cd677cbf1f99f08be9bf88750286c563feab12f97e65b7c1f46e0
Opcode Fuzzy Hash: f9bb4f0f7e5ed51cff6d742e1ecc16d7888a3fe4b78942494a6789a14b7f125b
Instruction Fuzzy Hash: E02127B1D003499FCF10CFA9D880AEEBBB5FF49354F04842AE558A7240D7389944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 077966C0, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 07796780

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: b5e3b3189be6f1d8b692ef750c2bd693e7214b76f983e9db8474bc340a9a7316
Instruction ID: 018f72f0c1c865ad634468f7ccf404463a4a532a8a72a9beecc64a0edd3ef22c
Opcode Fuzzy Hash: b5e3b3189be6f1d8b692ef750c2bd693e7214b76f983e9db8474bc340a9a7316
Instruction Fuzzy Hash: 6C217CB5D0525A8FCF10CFA9E54479EBBF0BB09264F1482AAD518E7340D735AA14CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07798B10, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07798B90

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 500ea167baa60a25c6dc3a69ab5e834aa194d58dd24a7aa2c84bc248196b64e7
Instruction ID: 59a2d3f4ab38596789fdb8a3e273a11de6046798556d5900416a4f8c3cec8442
Opcode Fuzzy Hash: 500ea167baa60a25c6dc3a69ab5e834aa194d58dd24a7aa2c84bc248196b64e7
Instruction Fuzzy Hash: 892116B1D003499FCF10CFAAC880AEEBBF5FF49314F548429E518A7240D7789944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07798888, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 07798906

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 6f468eab54591365d52dfecf2bb4d82d6f263c45ce19937adfeee6e1aa44e90e
Instruction ID: 4b29fba2cdb6b7fdcec619b13acb3e711fd1c86a302a0ed9b12515a2cf16f10d
Opcode Fuzzy Hash: 6f468eab54591365d52dfecf2bb4d82d6f263c45ce19937adfeee6e1aa44e90e
Instruction Fuzzy Hash: 212168B1D043098FCB10DFAAC4847EEBBF4AF49364F00842AD518A7340CB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07798880, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 07798906

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 6f70c0587a0c8d026241738000327d53e1c8680279e1d4b37994b93a212678d2
Instruction ID: a18a4947b852a5e4876abecdb428fccf078b0e8aede34627ee61cec211db95d1
Opcode Fuzzy Hash: 6f70c0587a0c8d026241738000327d53e1c8680279e1d4b37994b93a212678d2
Instruction Fuzzy Hash: B92157B1D043498FCB10DFA9D4807EEBBF1AF48364F14842AD568A7241CB78A948CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07793158, Relevance: 1.6, APIs: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 077931D3

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b8a35ee13f520576999a96de385f35e7726d7de8783a42b555f739cf9c960421
Instruction ID: 5c861d8c8ae3c0ac8bd07b60ea431c375babcfc97550908774d93dc798f285bc
Opcode Fuzzy Hash: b8a35ee13f520576999a96de385f35e7726d7de8783a42b555f739cf9c960421
Instruction Fuzzy Hash: 87211AB6D006499FCB10CF99D585BDEBBF4FB48320F10842AE458A7750D3789645CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07793160, Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 077931D3

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1faac65fb04694052fc7c1afe5b263adee308b1eacbfe30a4aebf2f824e39791
Instruction ID: 04c29146f32b44f56b7be5526e3aabc063b026ebd8caa3b104b1ec863f5061e6
Opcode Fuzzy Hash: 1faac65fb04694052fc7c1afe5b263adee308b1eacbfe30a4aebf2f824e39791
Instruction Fuzzy Hash: 9821E7B5D006499FCB10CF9AD884BDEFBF4FB48320F108429E958A7250D778AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07798960, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 077989CE

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 43dc42d816ba38d1f4ab98f6adadc1d1e0ccb1e1d93de91b2ff31202f0bde9ea
Instruction ID: 762ff2524164dadbbfe156821cde9b17904c409caf4dcf954f850e28f88cd0e8
Opcode Fuzzy Hash: 43dc42d816ba38d1f4ab98f6adadc1d1e0ccb1e1d93de91b2ff31202f0bde9ea
Instruction Fuzzy Hash: 5E1137729042499FCF10DFAAD8447EFBBF5AF48324F14882AE529A7250C775A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07798958, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 077989CE

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a80d4fc9bca15047f7c36574ef0373b96c76b64a01a999a2400fa0b797c70f56
Instruction ID: 902e8120871b577b080da1fe08468cf73e0d50682ad28261a0cff22efbb4503a
Opcode Fuzzy Hash: a80d4fc9bca15047f7c36574ef0373b96c76b64a01a999a2400fa0b797c70f56
Instruction Fuzzy Hash: 26117C76D043498FCF10CFA9D4447EEBBF1AF48324F14882AE565A7250C7759944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07796708, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 07796780

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: e4287393554cc37fc37c3b9313ba5a969f8ddcfa9f995235edb61fc0607bc835
Instruction ID: 6c9c2ede2a738b82b167de0029fec2456546d72dbd1154a6979fdcf007cfd01d
Opcode Fuzzy Hash: e4287393554cc37fc37c3b9313ba5a969f8ddcfa9f995235edb61fc0607bc835
Instruction Fuzzy Hash: 5C1123B5C0165A9BCB10CF9AD5847DEFBB4FB48364F10862AD828A7600D774AA44CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 07796710, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNELBASE(00000000), ref: 07796780

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: DebugOutputString
String ID:
API String ID: 1166629820-0
Opcode ID: 385a1938b7e6ac31e8c90c2f7477b3fc74435a73d655d9b7b085e04f170a4a89
Instruction ID: 95752247b75de63cd2791caa88db51a09b902c655e8bc819b20e6463941681e3
Opcode Fuzzy Hash: 385a1938b7e6ac31e8c90c2f7477b3fc74435a73d655d9b7b085e04f170a4a89
Instruction Fuzzy Hash: E31123B5C0065A9BCB10CF9AD584B9EFBB4FB48724F00822AD818A7200D774AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077987D0, Relevance: 1.6, APIs: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0779883A

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 960f7d54dbbbeb04ed0a419da685e2394a4c354ab84509f7341f755ada7256f9
Instruction ID: d5df266cfea9e5264cc58f2191712c7d690ff0c7ea5587cff48e85173f993b65
Opcode Fuzzy Hash: 960f7d54dbbbeb04ed0a419da685e2394a4c354ab84509f7341f755ada7256f9
Instruction Fuzzy Hash: A01146B5D043488BCB10CFA9D4447EEBBF5AF48224F14882AD629B7740D778A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 077987D8, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0779883A

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 34dc3c5211d81e703e81c1ccf774b4bb834143c571632f1a344d848b231a6f42
Instruction ID: bf12d5c8e95e7ebe2ca6e38423054e7838f151d5153289f0efcb4988d97e0182
Opcode Fuzzy Hash: 34dc3c5211d81e703e81c1ccf774b4bb834143c571632f1a344d848b231a6f42
Instruction Fuzzy Hash: C31128B1D043488BCB10DFAAD4447DEFBF5AB89324F148829D519A7740C778A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0779D648, Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0779D6A5

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 72cf45705d25d0876c5e2042b7c57ca9a0e49baa9db857c6be146ad12598ab9f
Instruction ID: 7ac9cc5a261aa9ccb5208dad9935ddaef4eb5a36104749e05f7c875837aa4d07
Opcode Fuzzy Hash: 72cf45705d25d0876c5e2042b7c57ca9a0e49baa9db857c6be146ad12598ab9f
Instruction Fuzzy Hash: 8D11E5B59007499FDB10CF99D884BDEBBF8EB48364F108419E958A7700C379A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0131D4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272663048.000000000131D000.00000040.00000001.sdmp, Offset: 0131D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca243415702c295b5adc3b41935898f2e9adb16f7ef0cd681892e7c292d1255
Instruction ID: f57287dc9c21d5326e315c0786f0f43c6ca1344254a257e6844062a76baa3096
Opcode Fuzzy Hash: 2ca243415702c295b5adc3b41935898f2e9adb16f7ef0cd681892e7c292d1255
Instruction Fuzzy Hash: 8A2148B1504244DFDB09CF84D8C4B2ABF65FB8832CF24C569E9050B20AC736D805C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0132D204, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272695449.000000000132D000.00000040.00000001.sdmp, Offset: 0132D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eac76dcfecb6f66ee82820c69e37af49dfe4aaaf1810431f0a7776d875870ba
Instruction ID: fa0963f93c75d8da06ff9a9fe70631835296eaf8c27e9615f300738568a54d69
Opcode Fuzzy Hash: 3eac76dcfecb6f66ee82820c69e37af49dfe4aaaf1810431f0a7776d875870ba
Instruction Fuzzy Hash: 312146B1608344EFDB01EF94D9C0B2ABB65FB85328F24C56DE9094B246C336D806CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0132D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272695449.000000000132D000.00000040.00000001.sdmp, Offset: 0132D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bdcde8f83cb88edec9634dd4ee0289796a511508f64ac0b031f3c98fbe13143
Instruction ID: 2596b4f45ffef62dbf88c9191713a03f7e574ca73d300e74ae16aaa6eba22b4b
Opcode Fuzzy Hash: 5bdcde8f83cb88edec9634dd4ee0289796a511508f64ac0b031f3c98fbe13143
Instruction Fuzzy Hash: 76214971608244DFCB11EF54D8C0B2ABB65FB84358F24C56DE90A4B356C73AD807CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0132D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272695449.000000000132D000.00000040.00000001.sdmp, Offset: 0132D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8a1061fbac86722a9c68b07f5b6a08635a6c09bcbfdaa18d8a5b74fe4875a43
Instruction ID: 1e05b29e1b478dc95ec9e4d318a15b71b0bd2d74b57e4791439d2ebd7eb68889
Opcode Fuzzy Hash: d8a1061fbac86722a9c68b07f5b6a08635a6c09bcbfdaa18d8a5b74fe4875a43
Instruction Fuzzy Hash: 9E2180755083809FCB02DF64D994B15BF71EB46214F28C5DAD8458F267C33A985ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0131D49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272663048.000000000131D000.00000040.00000001.sdmp, Offset: 0131D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70974ab4a4c2816a03f4b9a369bf25a07704c6fcdadf149384cc040b403512b7
Instruction ID: b44a91b24cf8b000c38af6548780b1aba004e68b12b875ef77ac8f9b18aa1b39
Opcode Fuzzy Hash: 70974ab4a4c2816a03f4b9a369bf25a07704c6fcdadf149384cc040b403512b7
Instruction Fuzzy Hash: CF11E172904280DFCB06CF44D9C4B16BF71FB84328F24C2A9D8050B21BC336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0132D1FF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272695449.000000000132D000.00000040.00000001.sdmp, Offset: 0132D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a5dd89c4e04e7b034098b9a6b3c5328201ea2187bf87cfbe925b6137f2990e
Instruction ID: a0b256a0c886af35676dbe0b6427433f2bcbbc6e905b71395cd38f601040c6b5
Opcode Fuzzy Hash: 13a5dd89c4e04e7b034098b9a6b3c5328201ea2187bf87cfbe925b6137f2990e
Instruction Fuzzy Hash: 8C11DD75504380DFDB02DF54D5C4B15BFA1FB85328F28C6A9D8494B656C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0131D759, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272663048.000000000131D000.00000040.00000001.sdmp, Offset: 0131D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18e79c641088907ab5f646f39c9ada4c2507a5aad3cc1e0137688bfab345f725
Instruction ID: 67d30e33a14481e676d8a2bb144430d82064a59e8d42d88e6a31227345c578d7
Opcode Fuzzy Hash: 18e79c641088907ab5f646f39c9ada4c2507a5aad3cc1e0137688bfab345f725
Instruction Fuzzy Hash: D401A7714083C49AE7154E55DC8876AFBDCEF46228F18C45AEE055A64EC3799844C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0131D758, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.272663048.000000000131D000.00000040.00000001.sdmp, Offset: 0131D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9777cae6d7c7d370111c6d40820131d257d173de25532de8dbc1a9e9c2d4e80d
Instruction ID: 2f9dc4e9c3dbe21e5ae83030871c3ddd5696a2103668f8dc70e6867dfb3bdf5b
Opcode Fuzzy Hash: 9777cae6d7c7d370111c6d40820131d257d173de25532de8dbc1a9e9c2d4e80d
Instruction Fuzzy Hash: 99F068714043849EE7158E55DCC4766FF98EF45634F18C45AED045B34AC3799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 077969B0, Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

BwJC, xrefs: 07796CDF

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID: BwJC
API String ID: 0-2762245850
Opcode ID: 2f347812130b70e1608d0c74fd99ff5e1b588838a74fbeb3a9f150c9b6ad7e58
Instruction ID: 57b9aa25adb6c96a61c257359819415da53340621d62b0499fe27d3eeb8118c4
Opcode Fuzzy Hash: 2f347812130b70e1608d0c74fd99ff5e1b588838a74fbeb3a9f150c9b6ad7e58
Instruction Fuzzy Hash: E6A115B4E052198BCF04CFA9D58159EFBF2EF8A350F25C529D404F7354EB34A9428B64

Uniqueness

Uniqueness Score: -1.00%

Function 077969A0, Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

BwJC, xrefs: 07796CDF

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID: BwJC
API String ID: 0-2762245850
Opcode ID: 9afe6ede9cebaee01103ed8d6dfdab08b495e8910ba1dfb52b43f0adb7d5c50a
Instruction ID: f2d90594167499dd3f43e438ab20e4f58ed2daba670c0056c23b5d19d2ee264f
Opcode Fuzzy Hash: 9afe6ede9cebaee01103ed8d6dfdab08b495e8910ba1dfb52b43f0adb7d5c50a
Instruction Fuzzy Hash: F4A116B4E052198BCF04CFA9D58159EFBF2EF8A350F25C62AD404F7354EB34A9428B64

Uniqueness

Uniqueness Score: -1.00%

Function 009B269C, Relevance: .9, Instructions: 886COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.271688057.00000000009B2000.00000002.00020000.sdmp, Offset: 009B0000, based on PE: true

Associated: 00000000.00000002.271678513.00000000009B0000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18795b196d953dd380f8a16a0a0692ae3d3066d23d3f4a15e2b3f67e50bc744e
Instruction ID: 78b8af74f35d8c9920e0dc7f3df574a14ff9c73ef4d759e81bb7a338ec71235a
Opcode Fuzzy Hash: 18795b196d953dd380f8a16a0a0692ae3d3066d23d3f4a15e2b3f67e50bc744e
Instruction Fuzzy Hash: 0872497244E3C29FD7138B748DA56C1BFB1AE5732435E45DBC4C08F0A3E229995ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0779B828, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761774f365ab81750747630ee915828e10a3f1e93ddcc5e316d4217cb94575ca
Instruction ID: b74d77cb49fd202d3904d6d006129dc3eba13decba5ad2d5979dc124a21a311c
Opcode Fuzzy Hash: 761774f365ab81750747630ee915828e10a3f1e93ddcc5e316d4217cb94575ca
Instruction Fuzzy Hash: 76A1D7B4E16209DFCF04CFA9E5819AEFBF2EB89340F10942AD515BB324D73499428F95

Uniqueness

Uniqueness Score: -1.00%

Function 077947A8, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d6f3746f479b421bc8e51b3281dc0303eaf94492332bbc77427119c7847fbb8
Instruction ID: 338ab64423357fc582d0089436f59b327211391fa4ddbdf866326ad2e45efcfe
Opcode Fuzzy Hash: 8d6f3746f479b421bc8e51b3281dc0303eaf94492332bbc77427119c7847fbb8
Instruction Fuzzy Hash: 91914EB4E041599BCB14DF99DA805AEFBB6FB89304F24C169D419A730AD730AD42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07794799, Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99921ecfbf8c6ffa63da33be56ff9f705c13efbcd10aa7894a6e324b8c6d068
Instruction ID: c8d001098752c8ec6fcc5a374069e04dc0a70e4865493b9f77e6a233c535c7fe
Opcode Fuzzy Hash: e99921ecfbf8c6ffa63da33be56ff9f705c13efbcd10aa7894a6e324b8c6d068
Instruction Fuzzy Hash: 1B914DB4E045599BCB14DFA9CA8056EFBB6FF89204F24C169D415A730AD730AD42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07796E4F, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa42a3575ddd57a17a0f20071575b6b4c758eb57b74ee633ea2aa82c934d688
Instruction ID: 5b958f19e1c8aa4aa3378b49bc9e1d692a0cde4c4f24da6d9648e3a6c898dbf7
Opcode Fuzzy Hash: 2aa42a3575ddd57a17a0f20071575b6b4c758eb57b74ee633ea2aa82c934d688
Instruction Fuzzy Hash: E47178B4E1620A8FCF04CFAAD5415EEFBB2BF89350F14D52AD414E7255DB349A418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 07796E60, Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de6177f781407dc291453a245196ecb27bf273ed6eebf280cf11d3f331456245
Instruction ID: 9e6ecb8a3235b468ead7b669edb2b9861a52aaa3b8f4cbebdc0b63bdfbf260a6
Opcode Fuzzy Hash: de6177f781407dc291453a245196ecb27bf273ed6eebf280cf11d3f331456245
Instruction Fuzzy Hash: B76148B4E1620A8FCF08CFAAD5415EEFBB2BB89350F14D52AD514F7254DB349A418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 07790007, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7884f25212730c5209d6e77ef6310a2b665b0f19afd8a897782502a35dae91b0
Instruction ID: 329036b3cf92f30dd2d8e2559aa58986a77c24003034ab0460998bb7ec39050a
Opcode Fuzzy Hash: 7884f25212730c5209d6e77ef6310a2b665b0f19afd8a897782502a35dae91b0
Instruction Fuzzy Hash: 6C314DB1E057558FEB4ACF6BDD1129ABBB3AFCA240F08C4BBC408A6265E6340545CF21

Uniqueness

Uniqueness Score: -1.00%

Function 07793B88, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e83552ed285cfe30224b55ecc47edf652495404a028f8713a20de7532bdf3f13
Instruction ID: da5a5a19e9f44d69a7896abe4bae1e90afb45ee0e0c057f1661d2a7ecdac13da
Opcode Fuzzy Hash: e83552ed285cfe30224b55ecc47edf652495404a028f8713a20de7532bdf3f13
Instruction Fuzzy Hash: CE317CB1E116199BDB08CFAAE941A9EFBF7FFC9200F14D52AE508A7254DB304A01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07793B85, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3798d2429d51ab6566618a7fcd7d5027b056c41cc35b05f28f003be612007f
Instruction ID: 3c68ec6341d5132e9cb0bebabc322662a80167ec233501e1ca2677d68fc9dd24
Opcode Fuzzy Hash: ed3798d2429d51ab6566618a7fcd7d5027b056c41cc35b05f28f003be612007f
Instruction Fuzzy Hash: 5F212DB1E116199BDB48CFAAE941A9EFBF7AFC9200F14D52AE408B7254DB304A01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 077957E8, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1deec5bc7476d1c24e306f6be56fcfda44766f9f987092c63e7c89734a40cf08
Instruction ID: 6c96a14ccfc6797511ca87380deb9e7af671acb664a568b6936406b39f331e0e
Opcode Fuzzy Hash: 1deec5bc7476d1c24e306f6be56fcfda44766f9f987092c63e7c89734a40cf08
Instruction Fuzzy Hash: 05210871E116199BDB48CFABD9406AEFBF7BFC8200F14C03AD408A7254EB305A118B61

Uniqueness

Uniqueness Score: -1.00%

Function 07793520, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ea285a6ddcb6f491df55ff9f51602dd1611e2bf884d9049512430e457c698e
Instruction ID: af4fe3983f18e849e837c949ea381a6336fc1cbb3c7aa36e29b383b299be6d3b
Opcode Fuzzy Hash: 55ea285a6ddcb6f491df55ff9f51602dd1611e2bf884d9049512430e457c698e
Instruction Fuzzy Hash: 052106B1E116199BDF08CFAAE940AEEFBF7BFC9210F14C07AD508A7214DB305A018B51

Uniqueness

Uniqueness Score: -1.00%

Function 07793510, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca787c650eda37c0d5c9582396c5fb683770832808bac80531307c79508c9e35
Instruction ID: 13169c78cd70ad3adc7f0d9e09a4ed3a9e09ad01a0175d90fe8bc0f870ffa779
Opcode Fuzzy Hash: ca787c650eda37c0d5c9582396c5fb683770832808bac80531307c79508c9e35
Instruction Fuzzy Hash: C62159B0E116589BDB08CFBAD9416AEFBF3BFC8200F18C47AD408A7254EB305A018F51

Uniqueness

Uniqueness Score: -1.00%

Function 07797D4F, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d041a20393fcb2b49ef434c7731a6cdd2f5e9f8fc1322c0cd916b55244a7a3e
Instruction ID: 3a9c6a701a4508b73d0a683d9fd94936bb5336323827b4302bedfa7d5bcc605b
Opcode Fuzzy Hash: 5d041a20393fcb2b49ef434c7731a6cdd2f5e9f8fc1322c0cd916b55244a7a3e
Instruction Fuzzy Hash: 62115EB1E216099FDB4CCF6AD9416AEBAF7AFC9240F14C47BD408A7354DA304A158BA1

Uniqueness

Uniqueness Score: -1.00%

Function 077957E7, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.281704589.0000000007790000.00000040.00000001.sdmp, Offset: 07790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5360df7e728f8542903371a65498153b8b3eeb2563945a7a74198cb500820b52
Instruction ID: 6ba8d646ba02625601e221967326063051cf5559c766b10b3e4ce6f99b812b43
Opcode Fuzzy Hash: 5360df7e728f8542903371a65498153b8b3eeb2563945a7a74198cb500820b52
Instruction Fuzzy Hash: F511E9B5E116199BDB48CFABD9416AEFAF7BFC8200F14C53AD408A7254EB304A518F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 6260 Parent PID: 5960 RegSvcs.exeCOMMON

Executed Functions

Function 028BB6C0, Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 028BB730
GetCurrentThread.KERNEL32 ref: 028BB76D
GetCurrentProcess.KERNEL32 ref: 028BB7AA
GetCurrentThreadId.KERNEL32 ref: 028BB803

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3f0c524a821c971da7f227efc439479f14bd9ee6132bf01224134b78fb66ee72
Instruction ID: 875469cb432b50cff8ec054a803c2cdbcf617550509a1c08485cdcf78c4948f8
Opcode Fuzzy Hash: 3f0c524a821c971da7f227efc439479f14bd9ee6132bf01224134b78fb66ee72
Instruction Fuzzy Hash: 165167B89006888FDB10CFAAD5887DEBBF1EF49308F248469E419A7351C774994ACB65

Uniqueness

Uniqueness Score: -1.00%

Function 028BB6D0, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 028BB730
GetCurrentThread.KERNEL32 ref: 028BB76D
GetCurrentProcess.KERNEL32 ref: 028BB7AA
GetCurrentThreadId.KERNEL32 ref: 028BB803

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 2d29c78ddd855f6bcba9030d38a0aa3ea4de8c254b3552007b071f6b2597d913
Instruction ID: 75e1702e82780974de90a306af69c7cb59d9c22dbd3ff5918ead82a21c4184be
Opcode Fuzzy Hash: 2d29c78ddd855f6bcba9030d38a0aa3ea4de8c254b3552007b071f6b2597d913
Instruction Fuzzy Hash: 5D5146B89006888FDB10CFAAD5487EEBBF1EF48318F208469E519B7350D774A945CF65

Uniqueness

Uniqueness Score: -1.00%

Function 028BFAA0, Relevance: 1.8, APIs: 1, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f284e7d12e32026ba8a69b09fb5636c9813eb889bd8d7a32a3ddce253ab99e
Instruction ID: 0105bf0399228233a2c0f168f65a1ea3cf17274b55fd336c26e194129867b511
Opcode Fuzzy Hash: f8f284e7d12e32026ba8a69b09fb5636c9813eb889bd8d7a32a3ddce253ab99e
Instruction Fuzzy Hash: EE919BB5C093889FDF06CFA4C8909DDBFB1EF1A340F59819AE444AB213D339594ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 06133560, Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.509154554.0000000006130000.00000040.00000001.sdmp, Offset: 06130000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641f931b4556e4acafcf4914274e2c5ba6a23115178289ece11f7392750cd038
Instruction ID: fa724a833b263f73d46cc741d67099f7af72b605a3fcfe9afb0962dec39b2786
Opcode Fuzzy Hash: 641f931b4556e4acafcf4914274e2c5ba6a23115178289ece11f7392750cd038
Instruction Fuzzy Hash: CE817BB1D042A9CFDF14CFA5D8806DEBBB1FF49304F21852AD526AB250DB709949CF91

Uniqueness

Uniqueness Score: -1.00%

Function 028B93E8, Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 028B962E

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 650f9692048a8c425f49b3aff916e6ea2ade5e7e3c1436e88853002db107939c
Instruction ID: eec0384f63d75630cd9e06609b1b5bb00f2457ea5a64654078bdd15d92086b8f
Opcode Fuzzy Hash: 650f9692048a8c425f49b3aff916e6ea2ade5e7e3c1436e88853002db107939c
Instruction Fuzzy Hash: 3C710478A00B058FD725DF29D44179ABBF1BF89218F008A2DD58AD7B50DB74E8468F91

Uniqueness

Uniqueness Score: -1.00%

Function 0613360C, Relevance: 1.6, APIs: 1, Instructions: 140networkCOMMON

Download Yara Rule

APIs

DnsQuery_A.DNSAPI(?,?,?,?,?,?), ref: 06133740

Memory Dump Source

Source File: 00000006.00000002.509154554.0000000006130000.00000040.00000001.sdmp, Offset: 06130000, based on PE: false

Similarity

API ID: Query_
String ID:
API String ID: 428220571-0
Opcode ID: 4686022d58058f8ec83daafc330f2bb3229e3e954a51921b06847c5c5b714eb1
Instruction ID: 490628c3b0328494beb5117572b400c358a6d79c6bab7230c5c3f0f0142e913b
Opcode Fuzzy Hash: 4686022d58058f8ec83daafc330f2bb3229e3e954a51921b06847c5c5b714eb1
Instruction Fuzzy Hash: 585125B1D042A8CFDF14CFA9D9846DEBBB1FF49304F248129E815AB250DB749986CF90

Uniqueness

Uniqueness Score: -1.00%

Function 028BFBF8, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 028BFD0A

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 46d8b473b8c1b51ef9f37f95aa93d384797e7ddb991fe30566e53ed8ae321f3a
Instruction ID: b715c59451f4c5c1a5e67f0547bfa1ef4c4a1d40c135a7ecbe1d369ef39e33e7
Opcode Fuzzy Hash: 46d8b473b8c1b51ef9f37f95aa93d384797e7ddb991fe30566e53ed8ae321f3a
Instruction Fuzzy Hash: 7741CFB5D003499FDF15CFA9C884ADEBBB5BF48314F24812AE919AB310D774A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 028BBCF9, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 028BBD87

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4597d33f00594e8703b3b9d94ea281d36bfe501d3721cab7756ab2f054cecef1
Instruction ID: c14e367acf1e0af7aed5d3e38ce30ef05895b49fe14decc637c55f23bba2cb02
Opcode Fuzzy Hash: 4597d33f00594e8703b3b9d94ea281d36bfe501d3721cab7756ab2f054cecef1
Instruction Fuzzy Hash: A221C4B59002489FDF10CFA9D984ADEBFF4EF48324F14841AE958A7310D778AA45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028BBD00, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 028BBD87

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6ec760e5a5810282f4106f0b870964a4570146047ea1235dd462cbbff4cd8512
Instruction ID: 725bc4a85dbe8d1e95f3af6c91820088ad6ad2f95bcd192da0b75535d1ff2821
Opcode Fuzzy Hash: 6ec760e5a5810282f4106f0b870964a4570146047ea1235dd462cbbff4cd8512
Instruction Fuzzy Hash: 4821C4B59002489FDB10CFA9D984ADEBFF4EB48324F14841AE958A7310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028B9849, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,028B96A9,00000800,00000000,00000000), ref: 028B98BA

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 89981a6aa9ae52cc6c41091502ac0b8da9432fb534b6c88d66041f9f4e1bb3bb
Instruction ID: 8bb162a9f7af0ac481813324b368af2a09f80e5906ca48fb8aca711d0433cdce
Opcode Fuzzy Hash: 89981a6aa9ae52cc6c41091502ac0b8da9432fb534b6c88d66041f9f4e1bb3bb
Instruction Fuzzy Hash: 391103B69002498FDB10CF9AD484ADEBBF4EB49314F04842EE529A7700C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028B8768, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,028B96A9,00000800,00000000,00000000), ref: 028B98BA

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6306cbeaf06e942acc3202068d72bb4c941ea5c6b0fb3fdfd745998aa15a3c0c
Instruction ID: a20132917d4ba6d334cb198e9f5818f3576cba79ca012ad9b66b3884f7f98eb8
Opcode Fuzzy Hash: 6306cbeaf06e942acc3202068d72bb4c941ea5c6b0fb3fdfd745998aa15a3c0c
Instruction Fuzzy Hash: A011F2BA9002498FDB10CF9AD444ADEBBF4AB49314F04842EE619B7700C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 028BFE38, Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 028BFE9D

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 081d04520becf914218dd05f006f8681afb85021c264940e9862366175b049d9
Instruction ID: 3219f23b76176847109f32b86115b9c1d5b3ddb30634bbf7778b69b1f0c44555
Opcode Fuzzy Hash: 081d04520becf914218dd05f006f8681afb85021c264940e9862366175b049d9
Instruction Fuzzy Hash: CF1103B99002898FDB10CF99D584BDFBBF4EB48324F10845AE959A7701C379A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028B95C8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 028B962E

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 403ac7175abaf8aba5e5ed255c1b4401a1777112570ea6331d9c43b66f018c7a
Instruction ID: c29f46550771d4790521e93691e7d904ee4df6e28130f3d2e71c42e6617b59ab
Opcode Fuzzy Hash: 403ac7175abaf8aba5e5ed255c1b4401a1777112570ea6331d9c43b66f018c7a
Instruction Fuzzy Hash: 5D11D2B5D006898FDB10CFAAD444ADEFBF4AF89224F14841AD519A7700D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 028BFE40, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 028BFE9D

Memory Dump Source

Source File: 00000006.00000002.502368446.00000000028B0000.00000040.00000001.sdmp, Offset: 028B0000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 5bebf72431cfe506dfcbe0c4c3090fcda896e486b737fd0256e02d892be564f9
Instruction ID: 0c711e5e4e9d3860887d55cc0cd871f682f7db9504e23fe3596feaa6b8408fc6
Opcode Fuzzy Hash: 5bebf72431cfe506dfcbe0c4c3090fcda896e486b737fd0256e02d892be564f9
Instruction Fuzzy Hash: DE1112B99002488FDB10CF99D984BEFBBF8EB48324F10841AE918A7700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 7lrH3syQoO.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets