Play interactive tour

Edit tour

Windows Analysis Report 01_extracted.exe

Overview

General Information

Sample Name:	01_extracted.exe
Analysis ID:	483429
MD5:	59f356092b9f54b4ee5563a2fb8a3255
SHA1:	252ee78cd1597581b9dc14253a77526ef344af38
SHA256:	2206669cc770b99bfdcc44079e5f218a3b4161c7c973f652d6a497a58031bf1d
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Malicious sample detected (through community Yara rule)

Sigma detected: NanoCore

Yara detected Nanocore RAT

Detected Nanocore Rat

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Uses dynamic DNS services

.NET source code contains potential unpacker

Uses 32bit PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Detected TCP or UDP traffic on non-standard ports

Internet Provider seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

Contains long sleeps (>= 3 min)

Enables debug privileges

Classification

Process Tree

System is w10x64

01_extracted.exe (PID: 2392 cmdline: 'C:\Users\user\Desktop\01_extracted.exe' MD5: 59F356092B9F54B4EE5563A2FB8A3255)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "af905a54-91e0-44a6-90a1-2d1125da", "Group": "septe123", "Domain1": "sunnysept.duckdns.org", "Domain2": "sunnysept.duckdns.org", "Port": 5500, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
01_extracted.exe	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
01_extracted.exe	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
01_extracted.exe	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
01_extracted.exe	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
Process Memory Space: 01_extracted.exe PID: 2392	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb485:$x1: NanoCore.ClientPluginHost 0xb4c2:$x2: IClientNetworkHost 0xefb3:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x1a039:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: 01_extracted.exe PID: 2392	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: 01_extracted.exe PID: 2392	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xb15b:$a: NanoCore 0xb16b:$a: NanoCore 0xb22a:$a: NanoCore 0xb239:$a: NanoCore 0xb431:$a: NanoCore 0xb445:$a: NanoCore 0xb485:$a: NanoCore 0x166a3:$a: NanoCore 0x166b5:$a: NanoCore 0x166f1:$a: NanoCore 0xb1ba:$b: ClientPlugin 0xb283:$b: ClientPlugin 0xb44e:$b: ClientPlugin 0xb48e:$b: ClientPlugin 0x166be:$b: ClientPlugin 0x166fa:$b: ClientPlugin 0x42df0:$b: ClientPlugin 0x42e15:$b: ClientPlugin 0x42e53:$b: ClientPlugin 0x42e78:$b: ClientPlugin 0x42ec2:$b: ClientPlugin
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.01_extracted.exe.260000.0.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.0.01_extracted.exe.260000.0.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.0.01_extracted.exe.260000.0.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.0.01_extracted.exe.260000.0.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\01_extracted.exe, ProcessId: 2392, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\01_extracted.exe, ProcessId: 2392, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\01_extracted.exe, ProcessId: 2392, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\01_extracted.exe, ProcessId: 2392, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: 01_extracted.exe

Avira: detected

Found malware configuration

Show sources

Source: 0.0.01_extracted.exe.260000.0.unpack

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "af905a54-91e0-44a6-90a1-2d1125da", "Group": "septe123", "Domain1": "sunnysept.duckdns.org", "Domain2": "sunnysept.duckdns.org", "Port": 5500, "KeyboardLogging": "Enable", "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Disable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4"}

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 01_extracted.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01_extracted.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01_extracted.exe PID: 2392, type: MEMORYSTR

Machine Learning detection for sample

Show sources

Source: 01_extracted.exe

Joe Sandbox ML: detected

Source: 0.0.01_extracted.exe.260000.0.unpack

Avira: Label: TR/Dropper.MSIL.Gen7

Source: 01_extracted.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: C:\Users\user\Desktop\01_extracted.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49733 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49734 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49735 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49736 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49737 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49744 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49745 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49746 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49767 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49773 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49774 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49777 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49783 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49786 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49787 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49788 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49790 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49795 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49797 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49798 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49799 -> 194.147.140.14:5500
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49800 -> 194.147.140.14:5500

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: sunnysept.duckdns.org

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: sunnysept.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.3:49733 -> 194.147.140.14:5500

Source: Joe Sandbox View

ASN Name: PTPEU PTPEU

Source: unknown

DNS traffic detected: queries for: sunnysept.duckdns.org

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 01_extracted.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01_extracted.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01_extracted.exe PID: 2392, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 01_extracted.exe, type: SAMPLE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 01_extracted.exe, type: SAMPLE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.0.01_extracted.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.0.01_extracted.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: 01_extracted.exe PID: 2392, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: 01_extracted.exe PID: 2392, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Source: 01_extracted.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 01_extracted.exe, type: SAMPLE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 01_extracted.exe, type: SAMPLE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 01_extracted.exe, type: SAMPLE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.0.01_extracted.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.0.01_extracted.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 0.0.01_extracted.exe.260000.0.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: 01_extracted.exe PID: 2392, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: 01_extracted.exe PID: 2392, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: 01_extracted.exe

Static PE information: Section: .rsrc ZLIB complexity 0.999732142857

Source: C:\Users\user\Desktop\01_extracted.exe

File read: C:\Users\user\Desktop\01_extracted.exe

Jump to behavior

Source: 01_extracted.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\01_extracted.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{af905a54-91e0-44a6-90a1-2d1125da804b}
Source: C:\Users\user\Desktop\01_extracted.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: C:\Users\user\Desktop\01_extracted.exe

File created: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/2@22/1

Source: 01_extracted.exe, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 01_extracted.exe, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 01_extracted.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.0.01_extracted.exe.260000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.01_extracted.exe.260000.0.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.01_extracted.exe.260000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: 01_extracted.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 01_extracted.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.0.01_extracted.exe.260000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.0.01_extracted.exe.260000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: C:\Users\user\Desktop\01_extracted.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: 01_extracted.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: C:\Users\user\Desktop\01_extracted.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 01_extracted.exe, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 01_extracted.exe, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.01_extracted.exe.260000.0.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.01_extracted.exe.260000.0.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: 01_extracted.exe, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 01_extracted.exe, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 0.0.01_extracted.exe.260000.0.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 0.0.01_extracted.exe.260000.0.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\Desktop\01_extracted.exe

File opened: C:\Users\user\Desktop\01_extracted.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe	Window / User API: threadDelayed 364			Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe	Window / User API: foregroundWindowGot 1016			Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe TID: 1536	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe TID: 5380	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\01_extracted.exe TID: 1836	Thread sleep time: -40000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\01_extracted.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\01_extracted.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 01_extracted.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01_extracted.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01_extracted.exe PID: 2392, type: MEMORYSTR

Remote Access Functionality:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 01_extracted.exe, type: SAMPLE
Source: Yara match	File source: 0.0.01_extracted.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 01_extracted.exe PID: 2392, type: MEMORYSTR

Detected Nanocore Rat

Show sources

Source: 01_extracted.exe, 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: 01_extracted.exe	String found in binary or memory: NanoCore.ClientPluginHost

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	Masquerading1	OS Credential Dumping	Process Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Non-Standard Port1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Virtualization/Sandbox Evasion21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Remote Access Software1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Application Window Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	System Information Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol21	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing12	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
01_extracted.exe	100%	Avira	TR/Dropper.MSIL.Gen7
01_extracted.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.01_extracted.exe.260000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen7		Download File

Domains

Source	Detection	Scanner	Label	Link
sunnysept.duckdns.org	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
sunnysept.duckdns.org	2%	Virustotal		Browse
sunnysept.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sunnysept.duckdns.org	194.147.140.14	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
sunnysept.duckdns.org	true	2%, Virustotal, Browse Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
194.147.140.14	sunnysept.duckdns.org	unknown		47285	PTPEU	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	483429
Start date:	15.09.2021
Start time:	00:26:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	01_extracted.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/2@22/1
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, UpdateNotificationMgr.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 23.211.4.86, 20.82.209.183, 40.112.88.60, 20.82.210.154, 80.67.82.235, 80.67.82.211, 23.203.80.193, 51.104.136.2, 20.50.102.62 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, arc.msn.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, e11290.dspg.akamaiedge.net, e12564.dspb.akamaiedge.net, go.microsoft.com, store-images.s-microsoft.com, go.microsoft.com.edgekey.net, arc.trafficmanager.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:27:00	API Interceptor	1046x Sleep call for process: 01_extracted.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
sunnysept.duckdns.org	83736354Invoicereceipt.vbs	Get hash	malicious	Browse	198.23.251.21

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
PTPEU	B4D3E2A30B09D1F2F33476F5234BD7A045973DDBC41A7.exe	Get hash	malicious	Browse	194.147.140.8
	18-ITEMS-RECEIPT.vbs	Get hash	malicious	Browse	194.147.140.20
	7-Items-receipt.vbs	Get hash	malicious	Browse	194.147.140.20
	9 ITEMS INVOICE RECEIPT.vbs	Get hash	malicious	Browse	194.147.140.20
	15 Items Receipt.vbs	Get hash	malicious	Browse	194.147.140.20
	14 Items receipt.vbs	Get hash	malicious	Browse	194.147.140.20
	16 Items receipt.vbs	Get hash	malicious	Browse	194.147.140.20
	SPT DRINGENDE BESTELLUNG _876453,pdf.exe	Get hash	malicious	Browse	194.147.140.9
	41-Items-invoice.vbs	Get hash	malicious	Browse	194.147.140.20
	Confirmaci#U00f3n del pedido- No HD10103,pdf.exe	Get hash	malicious	Browse	194.147.140.9
	SPT DRINGENDE BESTELLUNG _8764,pdf.exe	Get hash	malicious	Browse	194.147.140.9
	8 Items invoice.vbs	Get hash	malicious	Browse	194.147.140.20
	heimatec RFQ 4556_ DRINGEND,pdf.exe	Get hash	malicious	Browse	194.147.140.9
	Confirmarea comenzii noi-4019,pdf.exe	Get hash	malicious	Browse	194.147.140.9
	vuaXoDsazg	Get hash	malicious	Browse	194.147.142.145
	dsMBH5SmxL	Get hash	malicious	Browse	194.147.142.145
	YIupXk5F7b	Get hash	malicious	Browse	194.147.142.145
	pvbuEVYCUB	Get hash	malicious	Browse	194.147.142.145
	1jTsJsy5b8	Get hash	malicious	Browse	194.147.142.145
	fpAHzxlGRn	Get hash	malicious	Browse	194.147.142.145

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Users\user\Desktop\01_extracted.exe
File Type:	data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	7.089541637477408
Encrypted:	false
SSDEEP:	24:IQnybgC4jh+dQnybgC4jh+dQnybgC4jh+dQnybgC4jh+dQnybgC4jh+K:IknjhUknjhUknjhUknjhUknjhL
MD5:	7BEBBE1F1511163A3243CD8E0C75CC69
SHA1:	216B3AB5D802FA037A6EC5348B189398D8980B3C
SHA-256:	79A130865E9EFFFAA6C2E453942CE87F652681BCD76AAF987318300CAF5E3778
SHA-512:	4DCCB32411DEF72C938022B8675DA50B2DC4CD2C051B1C0377F63D6AAC42FC3D128B0ED580FB88954AB04A9E9EC8D272EBCCF74EB3F136BEF41ADBB845A1A530
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\Desktop\01_extracted.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:c:c
MD5:	315CCD3669C58A3177FFB7D0189A1EEF
SHA1:	678EF06864D26881E2DB1B9511A32B56CF988F3A
SHA-256:	FFA8198F332474004817F0E82E3C209AF881FCDF52F51F30497A6AE6BFB37866
SHA-512:	D9FD615BE3D8AFEC18151D0CE055602C346F1525FD8ECBCA47B6D204FAC13DCD821B385B46DFC39CE5B3BDEFB23D7E75DB6F583505A31CC412F473B1C05E7E4E
Malicious:	true
Reputation:	low
Preview:	.)5.x.H

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.446133348432718
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	01_extracted.exe
File size:	207360
MD5:	59f356092b9f54b4ee5563a2fb8a3255
SHA1:	252ee78cd1597581b9dc14253a77526ef344af38
SHA256:	2206669cc770b99bfdcc44079e5f218a3b4161c7c973f652d6a497a58031bf1d
SHA512:	7043f238357ef4d13c4ebd4c21371173157332547ccf0777594fcdcc566f78f865850a28fabb43ee23f24b26bbf03ed3ee0ea03b299c1565313db623ccbfc128
SSDEEP:	6144:gLV6Bta6dtJmakIM5wq+HjVCuSj2OjrtJrIOXu:gLV6BtpmkNq+DVcH85
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....'.T.....................`........... ........@.. .....................................................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x41e792
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:
Time Stamp:	0x54E927A1 [Sun Feb 22 00:49:37 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:	v2.0.50727
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e738	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x15d90	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x20000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1c798	0x1c800	False	0.594503837719	data	6.5980706265	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.reloc	0x20000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x22000	0x15d90	0x15e00	False	0.999732142857	data	7.99777392121	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_RCDATA	0x22058	0x15d38	TIM image, (48492,12466)

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/15/21-00:27:02.076627	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	50200	8.8.8.8	192.168.2.3
09/15/21-00:27:02.354546	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49733	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:07.400195	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	51281	8.8.8.8	192.168.2.3
09/15/21-00:27:07.631437	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49734	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:12.383586	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	49199	8.8.8.8	192.168.2.3
09/15/21-00:27:12.611541	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49735	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:17.744080	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49736	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:23.140472	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49737	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:28.739254	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49744	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:34.478410	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49745	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:39.773403	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	65110	8.8.8.8	192.168.2.3
09/15/21-00:27:39.998463	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49746	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:45.423084	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49767	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:50.997919	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49773	5500	192.168.2.3	194.147.140.14
09/15/21-00:27:56.021163	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49774	5500	192.168.2.3	194.147.140.14
09/15/21-00:28:02.027049	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49777	5500	192.168.2.3	194.147.140.14
09/15/21-00:28:07.677320	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	49563	8.8.8.8	192.168.2.3
09/15/21-00:28:08.684677	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49783	5500	192.168.2.3	194.147.140.14
09/15/21-00:28:15.052658	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49786	5500	192.168.2.3	194.147.140.14
09/15/21-00:28:21.468840	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49787	5500	192.168.2.3	194.147.140.14
09/15/21-00:28:28.077642	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	57084	8.8.8.8	192.168.2.3
09/15/21-00:28:28.305043	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49788	5500	192.168.2.3	194.147.140.14
09/15/21-00:28:35.011567	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	57568	8.8.8.8	192.168.2.3
09/15/21-00:28:35.239451	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49790	5500	192.168.2.3	194.147.140.14
09/15/21-00:28:41.718002	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49795	5500	192.168.2.3	194.147.140.14
09/15/21-00:28:48.005439	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	55435	8.8.8.8	192.168.2.3
09/15/21-00:28:48.231608	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49797	5500	192.168.2.3	194.147.140.14
09/15/21-00:28:54.654295	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49798	5500	192.168.2.3	194.147.140.14
09/15/21-00:29:00.711953	UDP	254	DNS SPOOF query response with TTL of 1 min. and no authority	53	56132	8.8.8.8	192.168.2.3
09/15/21-00:29:00.938829	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49799	5500	192.168.2.3	194.147.140.14
09/15/21-00:29:07.032341	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49800	5500	192.168.2.3	194.147.140.14

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 00:27:02.087652922 CEST	49733	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:02.312653065 CEST	5500	49733	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:02.312792063 CEST	49733	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:02.354546070 CEST	49733	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:02.632098913 CEST	5500	49733	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:02.632209063 CEST	49733	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:02.835180044 CEST	5500	49733	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:02.835506916 CEST	49733	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:02.914844990 CEST	5500	49733	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:02.915138006 CEST	49733	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:03.021835089 CEST	49733	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:03.059214115 CEST	5500	49733	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:03.059271097 CEST	49733	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:03.194070101 CEST	5500	49733	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:03.194232941 CEST	49733	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:07.404175043 CEST	49734	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:07.630057096 CEST	5500	49734	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:07.630222082 CEST	49734	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:07.631437063 CEST	49734	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:07.898245096 CEST	5500	49734	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:07.898408890 CEST	49734	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:08.021995068 CEST	49734	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:08.166990995 CEST	5500	49734	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:08.167257071 CEST	49734	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:12.386518955 CEST	49735	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:12.610210896 CEST	5500	49735	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:12.610375881 CEST	49735	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:12.611541033 CEST	49735	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:12.897222996 CEST	5500	49735	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:12.897310019 CEST	49735	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:13.069019079 CEST	5500	49735	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:13.069168091 CEST	49735	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:13.179615021 CEST	5500	49735	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:13.180906057 CEST	49735	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:13.240910053 CEST	49735	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:13.292944908 CEST	5500	49735	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:13.294959068 CEST	49735	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:13.460134983 CEST	5500	49735	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:13.460298061 CEST	49735	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:17.519107103 CEST	49736	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:17.742636919 CEST	5500	49736	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:17.742877960 CEST	49736	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:17.744080067 CEST	49736	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:18.022598028 CEST	5500	49736	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:18.022763968 CEST	49736	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:18.303188086 CEST	5500	49736	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:18.303390026 CEST	49736	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:18.306282997 CEST	5500	49736	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:18.306436062 CEST	49736	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:18.528666019 CEST	5500	49736	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:18.528908968 CEST	49736	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:18.584222078 CEST	5500	49736	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:18.741544008 CEST	49736	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:18.752623081 CEST	5500	49736	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:18.752809048 CEST	49736	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:22.913896084 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:23.137590885 CEST	5500	49737	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:23.139857054 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:23.140471935 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:23.412609100 CEST	5500	49737	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:23.413749933 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:23.696033001 CEST	5500	49737	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:23.696188927 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:23.737236023 CEST	5500	49737	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:23.737422943 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:23.960838079 CEST	5500	49737	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:23.961071968 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:24.100568056 CEST	5500	49737	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:24.100753069 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:24.240279913 CEST	5500	49737	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:24.240411043 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:24.304337025 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:24.324481010 CEST	5500	49737	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:24.324642897 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:24.521557093 CEST	5500	49737	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:24.521682024 CEST	49737	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:28.514481068 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:28.738651037 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:28.738778114 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:28.739253998 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:29.022232056 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:29.022490025 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:29.234245062 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:29.234370947 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:29.287017107 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:29.290369987 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:29.513585091 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:29.514445066 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:29.518325090 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:29.569633961 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:29.738221884 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:29.738471031 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:29.898152113 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:30.023263931 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:30.026415110 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:30.029808044 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:30.029836893 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:30.029861927 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:30.029885054 CEST	5500	49744	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:30.029921055 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:30.029977083 CEST	49744	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:34.251983881 CEST	49745	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:34.477664948 CEST	5500	49745	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:34.477802992 CEST	49745	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:34.478410006 CEST	49745	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:34.756129026 CEST	5500	49745	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:34.758852005 CEST	49745	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:35.037781000 CEST	5500	49745	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:35.037875891 CEST	49745	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:35.041951895 CEST	5500	49745	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:35.087317944 CEST	49745	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:35.261090994 CEST	5500	49745	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:35.262763023 CEST	49745	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:35.463027954 CEST	49745	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:35.486222029 CEST	5500	49745	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:35.486280918 CEST	49745	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:39.774439096 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:39.997792006 CEST	5500	49746	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:39.997940063 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:39.998462915 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:40.287087917 CEST	5500	49746	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:40.287353992 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:40.500714064 CEST	5500	49746	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:40.501406908 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:40.568922997 CEST	5500	49746	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:40.569073915 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:40.773298979 CEST	5500	49746	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:40.773358107 CEST	5500	49746	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:40.773416996 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:40.820580959 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:40.851381063 CEST	5500	49746	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:40.851500988 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:40.961822987 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:40.996881962 CEST	5500	49746	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:40.996974945 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:41.131593943 CEST	5500	49746	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:41.131692886 CEST	49746	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:45.198723078 CEST	49767	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:45.421967983 CEST	5500	49767	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:45.422111034 CEST	49767	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:45.423084021 CEST	49767	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:45.708916903 CEST	5500	49767	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:45.709029913 CEST	49767	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:45.983611107 CEST	5500	49767	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:45.983731031 CEST	49767	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:46.207953930 CEST	5500	49767	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:46.208173037 CEST	49767	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:46.430907965 CEST	49767	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:46.433439970 CEST	5500	49767	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:46.433527946 CEST	49767	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:50.772717953 CEST	49773	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:50.996829987 CEST	5500	49773	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:50.996937037 CEST	49773	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:50.997919083 CEST	49773	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:51.287838936 CEST	5500	49773	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:51.287997007 CEST	49773	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:51.288305044 CEST	5500	49773	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:51.336942911 CEST	49773	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:51.502216101 CEST	49773	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:51.512721062 CEST	5500	49773	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:51.512839079 CEST	49773	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:55.796912909 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:56.020030022 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:56.020190001 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:56.021162987 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:56.302578926 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:56.302834988 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:56.513561010 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:56.513863087 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:56.585140944 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:56.585278034 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:56.803273916 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:56.803427935 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:56.809946060 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:56.853560925 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:57.084465981 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:57.084604979 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:57.133650064 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:57.181293964 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:57.366038084 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:57.367028952 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:57.369596958 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:57.409466982 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:57.409661055 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:57.409740925 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:57.409859896 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:57.409883022 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:57.409934998 CEST	5500	49774	194.147.140.14	192.168.2.3
Sep 15, 2021 00:27:57.410006046 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:27:57.410021067 CEST	49774	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:01.802747965 CEST	49777	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:02.026079893 CEST	5500	49777	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:02.026289940 CEST	49777	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:02.027049065 CEST	49777	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:02.297368050 CEST	5500	49777	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:02.297502995 CEST	49777	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:02.569041967 CEST	5500	49777	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:02.569768906 CEST	49777	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:02.663475037 CEST	5500	49777	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:02.681468964 CEST	49777	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:02.850085974 CEST	5500	49777	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:02.850171089 CEST	49777	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:02.904966116 CEST	5500	49777	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:02.945839882 CEST	49777	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:03.132560968 CEST	5500	49777	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:03.132658958 CEST	49777	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:08.428544998 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:08.661370993 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:08.661672115 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:08.684676886 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:08.958945990 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:08.959026098 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:09.035727024 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:09.035810947 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:09.240695000 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:09.240793943 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:09.318581104 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:09.465130091 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:09.465986967 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:09.758136034 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:09.762042046 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.037533045 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.038062096 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.061600924 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.061635017 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.061765909 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.062114000 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.062134027 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.062215090 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.288316011 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.288373947 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.288419008 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.288430929 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.288460016 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.288465023 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.288476944 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.288536072 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.288562059 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.288621902 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.288702011 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.288758993 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.289041996 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.289098024 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.289113998 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.289149046 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.464308977 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.513179064 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.513202906 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.513326883 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.513475895 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.513760090 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.513782978 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.513828993 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.513854980 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.513993025 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.514338017 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.514357090 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.514395952 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.514434099 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.514703035 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.514775991 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.514833927 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.514974117 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.515321970 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.515386105 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.515441895 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.515484095 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.515522003 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.515957117 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.515978098 CEST	5500	49783	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:10.516015053 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:10.516041994 CEST	49783	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:14.825504065 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:15.049786091 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:15.050023079 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:15.052658081 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:15.320491076 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:15.320681095 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:15.601540089 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:15.601710081 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:15.654616117 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:15.654727936 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:15.878046989 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:15.878175974 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.102058887 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.102221012 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.397814035 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.400144100 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.668320894 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.669804096 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.738369942 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.738599062 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.738785028 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.738857031 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.739237070 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.739347935 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.739567041 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.739628077 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.933801889 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.944740057 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.944904089 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.963995934 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.964342117 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.964382887 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.964644909 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.964656115 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.964704990 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.964792013 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.964824915 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.964831114 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.964948893 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:16.964982033 CEST	5500	49786	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:16.965585947 CEST	49786	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:21.241826057 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:21.467549086 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:21.467752934 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:21.468839884 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:21.740968943 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:21.741162062 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:21.921854973 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:21.922051907 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.021564007 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.021738052 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.212501049 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.212584972 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.245282888 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.245357990 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.468703985 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.468863010 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.740969896 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.741058111 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.766596079 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.766690969 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.766712904 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.766746998 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.767155886 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.767211914 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.767368078 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.767410040 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.995529890 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.995567083 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.995718956 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.995857000 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.995879889 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.996005058 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.996383905 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.996408939 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.996459007 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.996510029 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:22.996774912 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.996795893 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:22.996850967 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.219022989 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.219198942 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.219391108 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.219474077 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.223683119 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223714113 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223733902 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223757982 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223779917 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223800898 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223820925 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223841906 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223861933 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223874092 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.223885059 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223905087 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223928928 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223948956 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.223949909 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223970890 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.223980904 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.224004030 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.224039078 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.267638922 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.449234962 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.450587034 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.450628996 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.450643063 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.450747013 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.450848103 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.450859070 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.456237078 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456307888 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456389904 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456409931 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456428051 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456444979 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456511021 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456527948 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456548929 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456568003 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456629038 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456646919 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456664085 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456717968 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456736088 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456793070 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456810951 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456825018 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456841946 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456859112 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456880093 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.456943035 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.457004070 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.457221031 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.457241058 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.457299948 CEST	5500	49787	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:23.479852915 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.479871035 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.479875088 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:23.479877949 CEST	49787	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:28.079173088 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:28.303431034 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:28.303797960 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:28.305042982 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:28.584526062 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:28.584611893 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:28.853620052 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:28.853802919 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:29.131704092 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:29.131824017 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:29.355716944 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:29.356091022 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:29.630850077 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:29.631231070 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:29.912175894 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:29.912405014 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:29.935741901 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:29.935811043 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:29.935976028 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:29.936028004 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:29.936284065 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:29.936352968 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:29.936554909 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:29.936621904 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.161844969 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.161879063 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.161901951 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.162703037 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.162729025 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.162969112 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.163001060 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.163021088 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.163028955 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.163045883 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.163047075 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.163068056 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.163086891 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.163134098 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.163192034 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.169011116 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.387262106 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.387284040 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.387295961 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.387347937 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.387377977 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.387595892 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.387721062 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.387841940 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.387900114 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.387927055 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.387954950 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.388149023 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.388201952 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.388322115 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.388370037 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.388412952 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.388478041 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.388706923 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.388856888 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.388971090 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.388997078 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.389061928 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.389194012 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.389246941 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.389379025 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.389440060 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.389547110 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.389622927 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:30.389754057 CEST	5500	49788	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:30.389811039 CEST	49788	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:35.013226986 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:35.236493111 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:35.236722946 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:35.239450932 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:35.506594896 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:35.506665945 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:35.584022045 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:35.584155083 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:35.787172079 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:35.787323952 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:35.865825891 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.010984898 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.011106014 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.287774086 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.287909985 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.568890095 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.569530010 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.590475082 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.590531111 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.590647936 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.590702057 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.590733051 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.590984106 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.591048002 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.816948891 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.817018986 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.817122936 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.817209959 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.817276955 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.817460060 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.817521095 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.817770004 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.817830086 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.818542957 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.818608046 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.818623066 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.818654060 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:36.818813086 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:36.818866968 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.041363955 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.041426897 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.041517019 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.042088985 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.042155981 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.042402029 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.042443991 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.042726040 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.042769909 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.042834997 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.042882919 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.043000937 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.043045998 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.043303013 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.043386936 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.043693066 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.043803930 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.043940067 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.044291019 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.044348001 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.044671059 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.044785023 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.044826031 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.044889927 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.044964075 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.045002937 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.045352936 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.046072960 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.046132088 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.144326925 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.266706944 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.266736984 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.266760111 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.266783953 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.267035007 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.267110109 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.281574965 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.285320997 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290400982 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290446997 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290467024 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290482998 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290498018 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290507078 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.290519953 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.290528059 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290561914 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290566921 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.290574074 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.290611982 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290633917 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290647984 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290653944 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.290663004 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290677071 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290705919 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290735006 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290760994 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290783882 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290810108 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290833950 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290858030 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290882111 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290905952 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290929079 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290952921 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.290976048 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.291002035 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.295418978 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.295432091 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.295433998 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:37.298732042 CEST	5500	49790	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:37.313709974 CEST	49790	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:41.494010925 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:41.717355013 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:41.717559099 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:41.718002081 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:42.006436110 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:42.006699085 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:42.100558996 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:42.154014111 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:42.288116932 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:42.291141987 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:42.515203953 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:42.515309095 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:42.787930012 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:42.788213968 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.070039988 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.070111990 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.093301058 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.093375921 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.097692013 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.097762108 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.097887993 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.097954988 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.098067999 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.098134041 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.316979885 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.317043066 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.317092896 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.317142963 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.321491003 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.321676016 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.321806908 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.322078943 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.322154999 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.322248936 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.322424889 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.322657108 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.322766066 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.540898085 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.541007042 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.541088104 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.541122913 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.541409016 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.541476965 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.545499086 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.545598984 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.545646906 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.545686007 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.546087027 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.546355963 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.546401978 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.546431065 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.546586037 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.546688080 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.546732903 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.546753883 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.546839952 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.546933889 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.547076941 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.547137022 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.547148943 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.547203064 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.547415018 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.547493935 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.547683001 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.547835112 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.547966957 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.560879946 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.764781952 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.764837980 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.764942884 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.764976978 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.765078068 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.765163898 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.765199900 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.765260935 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.765423059 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.765517950 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.765559912 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.765639067 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.765809059 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.765937090 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.765964031 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.766048908 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.769481897 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.769685030 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.770747900 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.771270990 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.771775007 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.771883965 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.771912098 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.772020102 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.772061110 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.772156000 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.772284985 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.772371054 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.772397995 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.772488117 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.772578001 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.772664070 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.772830009 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.772927046 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.773034096 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.773119926 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.773226976 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.773308992 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.773380995 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.773499012 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.773622036 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.773686886 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.773818970 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.773885965 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.774015903 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.774079084 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.774317980 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.774403095 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.774502993 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.774581909 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.774764061 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.774849892 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.774976969 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.775196075 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.775197983 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.775319099 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.775363922 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.775556087 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.775610924 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.775633097 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.775772095 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.775851965 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.775948048 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.776021957 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:43.776207924 CEST	5500	49795	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:43.776294947 CEST	49795	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:48.006985903 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:48.230206966 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:48.230463982 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:48.231607914 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:48.507673025 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:48.507843018 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:48.548239946 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:48.591999054 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:48.787309885 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:48.787440062 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.011533976 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.011744976 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.289068937 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.289124966 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.568589926 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.568727970 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.606211901 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.606319904 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.606745005 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.606761932 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.606829882 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.606849909 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.607198000 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.607291937 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.830383062 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.830467939 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.830487013 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.830552101 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.830610037 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.830683947 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.830765009 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.830826044 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.830862045 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.830926895 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.831088066 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.831171036 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.832299948 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.832393885 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:49.832609892 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:49.832710981 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.054999113 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.055275917 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.055293083 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.055357933 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.055728912 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.055850029 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.055968046 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.055985928 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.056056976 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.056139946 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.056232929 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.056344986 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.056457043 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.056616068 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.056699038 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.056752920 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.056827068 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.056899071 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.056958914 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.057143927 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.057209969 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.057282925 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.057332993 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.057507038 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.057564020 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.057738066 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.057795048 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.058515072 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.058552980 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.058612108 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.058628082 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.061722994 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.281239033 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.281465054 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.282166004 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.282234907 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.282294035 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.282315016 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.282419920 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.283353090 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.283473969 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.283493042 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.283607960 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.283797979 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.283992052 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.284061909 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.284140110 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.284295082 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.284451008 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.285214901 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.285274029 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.285329103 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.285372972 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.285383940 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.285440922 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.285495996 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.285501957 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.285521984 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.285638094 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.285705090 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.285815001 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.286031961 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.286143064 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.286206961 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.286309958 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.287623882 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.287715912 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.287832022 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.287890911 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.289921045 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.289980888 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290019989 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290026903 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290035963 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290067911 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290085077 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290124893 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290139914 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290175915 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290194988 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290222883 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290224075 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290266037 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290359974 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290371895 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290381908 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290416956 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290504932 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290543079 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290580988 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290596962 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290608883 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290632963 CEST	5500	49797	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:50.290644884 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:50.290688038 CEST	49797	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:54.429140091 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:54.652642012 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:54.652813911 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:54.654294968 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:54.928622007 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:54.928771019 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:55.211982965 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:55.212080956 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:55.277159929 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:55.326947927 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:55.490755081 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:55.490844011 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:55.716051102 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:55.718092918 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.006568909 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.006786108 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.293081999 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.293343067 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.377676964 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.377759933 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.377917051 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.378021955 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.378072977 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.378173113 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.378264904 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.531989098 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.568857908 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.568964958 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.602456093 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.602555037 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.602597952 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.602627993 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.602889061 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.602977037 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.603604078 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.603791952 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.604089022 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.604108095 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.604163885 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.604255915 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.604258060 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.604445934 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:28:56.604526997 CEST	5500	49798	194.147.140.14	192.168.2.3
Sep 15, 2021 00:28:56.604592085 CEST	49798	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:00.714360952 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:00.937860012 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:00.938009977 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:00.938828945 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:01.216667891 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:01.216779947 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:01.233666897 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:01.233792067 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:01.457175016 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:01.457298040 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:01.681252003 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:01.681472063 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:01.963170052 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:01.963344097 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.240447044 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.240643024 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.256932020 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.256987095 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.257133007 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.257158041 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.257234097 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.257328033 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.257427931 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.480942011 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.481090069 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.481101036 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.481148958 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.481432915 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.481486082 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.481686115 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.481736898 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.481950998 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.482012033 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.482187033 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.482245922 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.482518911 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.482578039 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.482844114 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.482908010 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.705951929 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.706011057 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.706085920 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.706136942 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.706235886 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.706298113 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.706518888 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.706604958 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.706777096 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.706837893 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.706979036 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.707035065 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.707220078 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.707278967 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.707505941 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.707565069 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.707763910 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.707819939 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.708014011 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.708071947 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.708877087 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.708901882 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.708940983 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.708961010 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.710669041 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.710731983 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.711159945 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.711229086 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.711329937 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.711445093 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.711905956 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.711963892 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.766182899 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.931418896 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.931478977 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.931619883 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.932095051 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.932275057 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.932346106 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.932399035 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.932585001 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.932693005 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.932773113 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.932846069 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.933140993 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.933223963 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.933330059 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.933402061 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.933984041 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.934058905 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.934583902 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.934665918 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.934999943 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.935074091 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.935210943 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.935292006 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.935483932 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.935569048 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.935664892 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.935777903 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.935967922 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.936069012 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.936208010 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.936315060 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.936420918 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.936522961 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.936613083 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.936738014 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.936939001 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.937026978 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.937077999 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.937303066 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.937514067 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.937676907 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.938102007 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.938182116 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.938373089 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.938492060 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.938524008 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.938529015 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.938534975 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.938539028 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.938544035 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.938548088 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.938678980 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.938774109 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.938978910 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.939145088 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.939301014 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.939306974 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.939337969 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.939397097 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.939547062 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.939651012 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.939796925 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.939888000 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:02.940181017 CEST	5500	49799	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:02.940269947 CEST	49799	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:06.808574915 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:07.031862020 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:07.031992912 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:07.032341003 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:07.311343908 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:07.311507940 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:07.535439014 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:07.536214113 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:07.818856955 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:07.840214014 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:07.840250015 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:07.840526104 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:07.842170954 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:07.842202902 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:07.842247963 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.064007998 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.064044952 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.064157963 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.064263105 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.064374924 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.064471960 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.065265894 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.065440893 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.065581083 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.065624952 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.065839052 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.065911055 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.293814898 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.293874025 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.293915033 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.294029951 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.294032097 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.294092894 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.294162989 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.294403076 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.294465065 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.294631004 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.294888020 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.294951916 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.295344114 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.295577049 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.295638084 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.295800924 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.295959949 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.296010017 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.296201944 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.296344995 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.296406984 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.296595097 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.296715975 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.296941042 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.519330978 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.519468069 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.519572973 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.519670963 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.520595074 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.521532059 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.521627903 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.521707058 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.521909952 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.521994114 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.522217989 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.522471905 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.522552013 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.522608042 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.523001909 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.523087025 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.523358107 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.523401976 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.523478985 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.523526907 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.523796082 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.523880005 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.523906946 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.523976088 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.524070978 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.524290085 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.524364948 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.524490118 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.524636030 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.524710894 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.524817944 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.524976969 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.525222063 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.525362015 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.525371075 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.525506973 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.525578976 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.525603056 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.525679111 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.525760889 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.525928020 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.526014090 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.526119947 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.526253939 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.526319981 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.526397943 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.526572943 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.526653051 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.743068933 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.743293047 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.743360043 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.743369102 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.743571043 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.743663073 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.745686054 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.745722055 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.745801926 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.746608019 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.746665001 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.746704102 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.746731043 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.747534037 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.747608900 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.748037100 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.748076916 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.748145103 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.748617887 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.748660088 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.748725891 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.749202967 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.749536991 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.749614000 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.749685049 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.749882936 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.749969006 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.750236034 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.750355959 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.750544071 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.750617027 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.750961065 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.751010895 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.751137018 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.751168013 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.751270056 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.751379967 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.751549959 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.751627922 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.751811028 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.751852989 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.751933098 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.752358913 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.752548933 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.752621889 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.752729893 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.752995014 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.753048897 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.753098965 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.753128052 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.753216982 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.753340960 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.753550053 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.753637075 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.753786087 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.753937960 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.754117966 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.754203081 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.754517078 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.754620075 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.754661083 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.754801035 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.754842997 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.754884958 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.755073071 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.755151987 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.758939981 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.758985996 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.759035110 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.759073019 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.759078026 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.759146929 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.759191990 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.759222984 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.759313107 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.966908932 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.967160940 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.967190981 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.967255116 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.967382908 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.967453003 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.968971968 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.969343901 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.969443083 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.969641924 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.969976902 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.970060110 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.970727921 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.970845938 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.971002102 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.971357107 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.972383022 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.972475052 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.973287106 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.973350048 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.973464012 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.973675013 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.973726988 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.973773956 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.973810911 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.973896980 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.974173069 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.975033045 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.975877047 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.976079941 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.976316929 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.976825953 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.977011919 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.977332115 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.978020906 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.978193045 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.978308916 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.978399992 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.978667021 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.978743076 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.978846073 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.978946924 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.979020119 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.979198933 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.979341030 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.979449987 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.979588032 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.979674101 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.979899883 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.980187893 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.980410099 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.980412006 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.980676889 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.980753899 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.980902910 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.980998993 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.981087923 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.981213093 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.981364965 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.981482029 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.981642008 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.981836081 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.981893063 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.982610941 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.982752085 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.982820988 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.982871056 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.982914925 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.983007908 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.983225107 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.984008074 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.984088898 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:08.984097958 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.984180927 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:08.984348059 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.190690041 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.190840960 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.191046953 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.191133976 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.191283941 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.191950083 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.192307949 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.192519903 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.192591906 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.193759918 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.194202900 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.194428921 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.194447041 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.194586992 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.195072889 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.195267916 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.195507050 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.195581913 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.196516991 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.197262049 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.197348118 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.197369099 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.197580099 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.197670937 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.197871923 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.198043108 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.198168993 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.199708939 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.200516939 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.200567007 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.200582981 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.200611115 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.200671911 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.201793909 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.202425957 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.202490091 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.202826977 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.203058004 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.203125954 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.203315973 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.203649044 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.203716993 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.206103086 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.206145048 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.206207037 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.207109928 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.207191944 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.207231045 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.207263947 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.207272053 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.207343102 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.207818985 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.208070993 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.208129883 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.208547115 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.220976114 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.221110106 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.221206903 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.221286058 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.221357107 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.221473932 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.221632004 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.221716881 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.221879959 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.221997976 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.222064018 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.222181082 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.222426891 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.222491980 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.222625017 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.222912073 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.223186970 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.223258972 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.223639965 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.223714113 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.415079117 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.415402889 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.415461063 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.415786028 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.415852070 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.415905952 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.416012049 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.416301012 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.416357040 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.416613102 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.416732073 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.416779995 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.416893005 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.417824030 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.417877913 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.417902946 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.417970896 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.418015957 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.418524027 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.418776989 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.418827057 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.418893099 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.419142008 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.419190884 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.419538975 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.419620991 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.419672966 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.419830084 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.420058966 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.420104980 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.420619965 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.420979023 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.421030998 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.421178102 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.421457052 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.421504974 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.421916008 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.421977043 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.422028065 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.422276974 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.422517061 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.422568083 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.422600985 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.422792912 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.422852993 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.423079014 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.423634052 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.423686981 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.423733950 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.423937082 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.423990965 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.424235106 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.424474001 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.424530029 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.424633980 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.424793959 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.424863100 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.426971912 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.427046061 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.427098036 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.427150011 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.427278042 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.427300930 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.427354097 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.427387953 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.427444935 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.427479982 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.427917957 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.427951097 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.428059101 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.428086042 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.428143978 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.430856943 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431004047 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431057930 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.431092024 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431152105 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431217909 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.431267977 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431329966 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431381941 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.431435108 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431519032 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431550980 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431560993 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.431765079 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.431817055 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.431957960 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.432123899 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.432177067 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.432374001 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.432615995 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.432670116 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.432848930 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.432967901 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.433018923 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.445425034 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.445589066 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.445775032 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.607773066 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:09.880897045 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:09.997312069 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:10.015161037 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:10.240964890 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:10.247435093 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:10.475486040 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:10.475641966 CEST	49800	5500	192.168.2.3	194.147.140.14
Sep 15, 2021 00:29:10.700081110 CEST	5500	49800	194.147.140.14	192.168.2.3
Sep 15, 2021 00:29:10.701426983 CEST	49800	5500	192.168.2.3	194.147.140.14

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 15, 2021 00:26:54.170667887 CEST	60985	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:26:54.207604885 CEST	53	60985	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:01.947751045 CEST	50200	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:02.076627016 CEST	53	50200	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:07.272417068 CEST	51281	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:07.400194883 CEST	53	51281	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:12.254900932 CEST	49199	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:12.383585930 CEST	53	49199	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:17.482837915 CEST	50620	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:17.516397953 CEST	53	50620	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:22.885296106 CEST	64938	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:22.912415028 CEST	53	64938	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:25.565556049 CEST	60152	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:25.609678984 CEST	53	60152	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:25.988378048 CEST	57544	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:26.024219036 CEST	53	57544	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:28.477812052 CEST	55984	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:28.513227940 CEST	53	55984	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:34.172791004 CEST	64185	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:34.251058102 CEST	53	64185	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:39.649972916 CEST	65110	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:39.773402929 CEST	53	65110	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:40.543015003 CEST	58361	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:40.586541891 CEST	53	58361	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:45.167210102 CEST	63492	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:45.197247028 CEST	53	63492	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:50.734563112 CEST	60831	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:50.770559072 CEST	53	60831	8.8.8.8	192.168.2.3
Sep 15, 2021 00:27:55.767343998 CEST	60100	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:27:55.794513941 CEST	53	60100	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:01.209887981 CEST	53195	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:01.254210949 CEST	53	53195	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:01.768517017 CEST	50141	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:01.800992966 CEST	53	50141	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:04.530802011 CEST	53023	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:04.567562103 CEST	53	53023	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:07.552164078 CEST	49563	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:07.677320004 CEST	53	49563	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:14.785747051 CEST	51352	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:14.822325945 CEST	53	51352	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:21.204571962 CEST	59349	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:21.239867926 CEST	53	59349	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:27.949857950 CEST	57084	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:28.077641964 CEST	53	57084	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:34.182403088 CEST	58823	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:34.260754108 CEST	53	58823	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:34.886750937 CEST	57568	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:35.011567116 CEST	53	57568	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:35.031457901 CEST	50540	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:35.067050934 CEST	53	50540	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:39.408174992 CEST	54366	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:39.448267937 CEST	53	54366	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:41.205141068 CEST	53034	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:41.248573065 CEST	53	53034	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:41.456763029 CEST	57762	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:41.491748095 CEST	53	57762	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:47.879156113 CEST	55435	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:48.005439043 CEST	53	55435	8.8.8.8	192.168.2.3
Sep 15, 2021 00:28:54.399796963 CEST	50713	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:28:54.427526951 CEST	53	50713	8.8.8.8	192.168.2.3
Sep 15, 2021 00:29:00.587172031 CEST	56132	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:29:00.711952925 CEST	53	56132	8.8.8.8	192.168.2.3
Sep 15, 2021 00:29:06.781688929 CEST	58987	53	192.168.2.3	8.8.8.8
Sep 15, 2021 00:29:06.808100939 CEST	53	58987	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 15, 2021 00:27:01.947751045 CEST	192.168.2.3	8.8.8.8	0x369f	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:07.272417068 CEST	192.168.2.3	8.8.8.8	0x673	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:12.254900932 CEST	192.168.2.3	8.8.8.8	0x55cf	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:17.482837915 CEST	192.168.2.3	8.8.8.8	0x3be6	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:22.885296106 CEST	192.168.2.3	8.8.8.8	0x18e9	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:28.477812052 CEST	192.168.2.3	8.8.8.8	0xc3fb	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:34.172791004 CEST	192.168.2.3	8.8.8.8	0xd60b	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:39.649972916 CEST	192.168.2.3	8.8.8.8	0xd20	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:45.167210102 CEST	192.168.2.3	8.8.8.8	0x7879	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:50.734563112 CEST	192.168.2.3	8.8.8.8	0x7d4f	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:55.767343998 CEST	192.168.2.3	8.8.8.8	0x7772	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:01.768517017 CEST	192.168.2.3	8.8.8.8	0x5cc8	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:07.552164078 CEST	192.168.2.3	8.8.8.8	0x12e5	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:14.785747051 CEST	192.168.2.3	8.8.8.8	0xfdc0	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:21.204571962 CEST	192.168.2.3	8.8.8.8	0x114a	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:27.949857950 CEST	192.168.2.3	8.8.8.8	0xe839	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:34.886750937 CEST	192.168.2.3	8.8.8.8	0x10c6	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:41.456763029 CEST	192.168.2.3	8.8.8.8	0x3859	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:47.879156113 CEST	192.168.2.3	8.8.8.8	0x36fb	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:54.399796963 CEST	192.168.2.3	8.8.8.8	0xd1d0	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:29:00.587172031 CEST	192.168.2.3	8.8.8.8	0x1acf	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)
Sep 15, 2021 00:29:06.781688929 CEST	192.168.2.3	8.8.8.8	0x4c4d	Standard query (0)	sunnysept.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Sep 15, 2021 00:27:02.076627016 CEST	8.8.8.8	192.168.2.3	0x369f	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:07.400194883 CEST	8.8.8.8	192.168.2.3	0x673	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:12.383585930 CEST	8.8.8.8	192.168.2.3	0x55cf	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:17.516397953 CEST	8.8.8.8	192.168.2.3	0x3be6	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:22.912415028 CEST	8.8.8.8	192.168.2.3	0x18e9	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:28.513227940 CEST	8.8.8.8	192.168.2.3	0xc3fb	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:34.251058102 CEST	8.8.8.8	192.168.2.3	0xd60b	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:39.773402929 CEST	8.8.8.8	192.168.2.3	0xd20	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:45.197247028 CEST	8.8.8.8	192.168.2.3	0x7879	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:50.770559072 CEST	8.8.8.8	192.168.2.3	0x7d4f	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:27:55.794513941 CEST	8.8.8.8	192.168.2.3	0x7772	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:01.800992966 CEST	8.8.8.8	192.168.2.3	0x5cc8	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:07.677320004 CEST	8.8.8.8	192.168.2.3	0x12e5	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:14.822325945 CEST	8.8.8.8	192.168.2.3	0xfdc0	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:21.239867926 CEST	8.8.8.8	192.168.2.3	0x114a	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:28.077641964 CEST	8.8.8.8	192.168.2.3	0xe839	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:35.011567116 CEST	8.8.8.8	192.168.2.3	0x10c6	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:41.491748095 CEST	8.8.8.8	192.168.2.3	0x3859	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:48.005439043 CEST	8.8.8.8	192.168.2.3	0x36fb	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:28:54.427526951 CEST	8.8.8.8	192.168.2.3	0xd1d0	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:29:00.711952925 CEST	8.8.8.8	192.168.2.3	0x1acf	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)
Sep 15, 2021 00:29:06.808100939 CEST	8.8.8.8	192.168.2.3	0x4c4d	No error (0)	sunnysept.duckdns.org	194.147.140.14	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: 01_extracted.exe PID: 2392 Parent PID: 5692

General

Start time:	00:26:59
Start date:	15/09/2021
Path:	C:\Users\user\Desktop\01_extracted.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\01_extracted.exe'
Imagebase:	0x260000
File size:	207360 bytes
MD5 hash:	59F356092B9F54B4EE5563A2FB8A3255
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000000.210003414.0000000000262000.00000002.00020000.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of open application windows. Window listings could convey information about how the system is used or give context to information collected by a keylogger.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 01_extracted.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Overview

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers